# CA Owner Audit Dump - Deutsche Telekom Security GmbH

Generated: 2026-07-28T05:56:57.870363Z

## CA Owner Summary

- Name: Deutsche Telekom Security GmbH
- Country: Germany
- Website: -
- Problem Reporting: mailto:TrustCenter-Roots[at]telekom[dot]de
- CP/CPS URLs: https://www.telesec.de/en/public-key-infrastructure/support/cp-cps, https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=775:cp-telesec-globalroot, https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=776:cps-telesec-globalroot, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf, https://corporate-pki.telekom.de/en/cps/cps.htm, https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf, http://corporate-pki1.telekom.de/cps/cps.htm, https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf, https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cp_v16-en.pdf, https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cps_v16-en.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CP.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CPS.pdf, https://www.pki.dfn.de/policies/informationen/, http://pki.fraunhofer.de/cp/Certificate_Policy_Fraunhofer_Corporate_PKI.pdf, http://pki.fraunhofer.de/cp/Certification_Practice_Statement_Fraunhofer_Corporate_PKI.pdf, http://sbca.telesec.de/sbca/download/cp.pdf, https://www.telesec.de/en/sbca-en/support/cps, http://www.telesec.de/en/serverpass/cps.html, http://pki.telesec.de/cps/cps.html, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-V3.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V4.0.pdf, http://sbca.telesec.de/cps/cps2.pdf, http://pks.telesec.de/cps/cps.pdf, https://www.telesec.de/en/signaturecard/support/download-area/category/107-zertifizierungserklaerung-cps, https://telesec.de/assets/downloads/PKI-Repository/PKS-CPS_07.00_EN.pdf, http://www.telesec.de/serverpass/cps.html
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2019072606_Deutsche-Telekom-Root-CA-2_V1.0_s.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_SBR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_EV.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2023062101_Telekom_Security_2023_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_Standard_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_TLS-BR_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_SBR_V1.0.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2018121901_BrowserAttestation_List_s.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/67122UE_s.pdf, https://www.pki.dfn.de/ueberblick-dfn-pki/
- Root Programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: mailto:TrustCenter-Roots[at]telekom[dot]de
- CP/CPS URLs: https://www.telesec.de/en/public-key-infrastructure/support/cp-cps, https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=775:cp-telesec-globalroot, https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=776:cps-telesec-globalroot, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf, https://corporate-pki.telekom.de/en/cps/cps.htm, https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf, http://corporate-pki1.telekom.de/cps/cps.htm, https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf, https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cp_v16-en.pdf, https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cps_v16-en.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CP.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CPS.pdf, https://www.pki.dfn.de/policies/informationen/, http://pki.fraunhofer.de/cp/Certificate_Policy_Fraunhofer_Corporate_PKI.pdf, http://pki.fraunhofer.de/cp/Certification_Practice_Statement_Fraunhofer_Corporate_PKI.pdf, http://sbca.telesec.de/sbca/download/cp.pdf, https://www.telesec.de/en/sbca-en/support/cps, http://www.telesec.de/en/serverpass/cps.html, http://pki.telesec.de/cps/cps.html, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-V3.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V4.0.pdf, http://sbca.telesec.de/cps/cps2.pdf, http://pks.telesec.de/cps/cps.pdf, https://www.telesec.de/en/signaturecard/support/download-area/category/107-zertifizierungserklaerung-cps, https://telesec.de/assets/downloads/PKI-Repository/PKS-CPS_07.00_EN.pdf, http://www.telesec.de/serverpass/cps.html
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2019072606_Deutsche-Telekom-Root-CA-2_V1.0_s.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_SBR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_EV.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2023062101_Telekom_Security_2023_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_Standard_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_TLS-BR_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_SBR_V1.0.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2018121901_BrowserAttestation_List_s.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/67122UE_s.pdf, https://www.pki.dfn.de/ueberblick-dfn-pki/
- Repository URLs: https://www.telesec.de/de/service/downloads/pki-repository/, https://www.pki.dfn.de/policies/informationen/, https://www.pki.dfn.de/root/globalroot/, https://www.pki.fraunhofer.de/cmsExtern/de/pkis-und-zertifizierungsstellen/fraunhofer-pki-version-2.html, https://www.telesec.de/de/sbca/support/ca-zertifikate, https://www.telesec.de/en/sbca-en, https://www.telesec.de/en/serverpass-en/support/root-ca, https://www.telesec.de/de/serverpass/support/root-sub-ca-zertifikate, http://pks.telesec.de, https://www.telesec.de/en/signaturecard
- Root programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2 | yes | expired | 1999-07-09 to 2019-07-09 | - | 5 | - | historical errors: 1 |
| 2 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2 | yes | unknown | 2008-10-01 to 2033-10-01 | - | - | - | clean |
| 3 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3 | yes | unknown | 2008-10-01 to 2033-10-01 | - | - | - | clean |
| 4 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021 | yes | unknown | 2021-03-18 to 2046-03-17 | - | - | - | clean |
| 5 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023 | yes | unknown | 2023-03-28 to 2048-03-27 | - | - | - | clean |
| 6 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020 | yes | unknown | 2020-08-25 to 2045-08-25 | - | - | - | clean |
| 7 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023 | yes | unknown | 2023-03-28 to 2048-03-27 | - | - | - | clean |
| 8 | countryName=DE, organizationName=Alfred-Wegener-Institut, commonName=Alfred-Wegener-Institut CA - G01, emailAddress=pki@awi.de | yes | expired | 2008-04-30 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 9 | countryName=DE, organizationName=Alfred-Wegener-Institut, commonName=Alfred-Wegener-Institut CA - G01, emailAddress=pki@awi.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 10 | countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d. Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de | yes | revoked, expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 11 | countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d.Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de | yes | expired | 2007-03-13 to 2019-03-12 | - | - | - | historical errors: 1 |
| 12 | countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d.Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de | yes | expired | 2014-05-19 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 13 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Alice-Salomon-Hochschule Berlin, organizationalUnitName=ComZ, commonName=ASH BERLIN CA - G01, emailAddress=ca@ash-berlin.eu | yes | expired | 2015-03-24 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 14 | countryName=DE, organizationName=Asse-GmbH, commonName=Asse-GmbH CA - G01, emailAddress=ca.asse@asse-gmbh.de | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 15 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Glauchau, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, commonName=BA Glauchau CA - G01, emailAddress=admins@ba-glauchau.de | yes | expired | 2013-06-18 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 16 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Glauchau, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, commonName=BA Glauchau CA - G01, emailAddress=admins@ba-glauchau.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 17 | countryName=DE, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Dresden, organizationalUnitName=Rechenzentrum, commonName=BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress=rechenzentrum@ba-dresden.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 18 | countryName=DE, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Dresden, organizationalUnitName=Rechenzentrum, commonName=BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress=rechenzentrum@ba-dresden.de | yes | expired | 2012-12-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 19 | countryName=DE, organizationName=Berufsakademie Sachsen Staatliche Studienakademie Bautzen, commonName=BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress=ca@ba-bautzen.de | yes | expired | 2010-03-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 20 | countryName=DE, organizationName=Berufsakademie Sachsen Staatliche Studienakademie Bautzen, commonName=BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress=ca@ba-bautzen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 21 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bergisch Gladbach, organizationName=Bundesanstalt fuer Strassenwesen, commonName=BAST CA - G01, emailAddress=ca@bast.de | yes | expired | 2015-03-24 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 22 | countryName=DE, organizationName=Bundesanstalt fuer Wasserbau, commonName=BAW CA, emailAddress=baw-ca@baw.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 23 | countryName=DE, organizationName=Bundesanstalt fuer Wasserbau, commonName=BAW CA, emailAddress=baw-ca@baw.de | yes | expired | 2007-05-22 to 2019-05-21 | - | 1 | - | historical errors: 1 |
| 24 | countryName=DE, organizationName=Berlin-Brandenburgische Akademie der Wissenschaften, organizationalUnitName=Informationstechnologie, commonName=BBAW-CA 1, emailAddress=ca@bbaw.de | yes | expired | 2009-10-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 25 | countryName=DE, organizationName=Berlin-Brandenburgische Akademie der Wissenschaften, organizationalUnitName=Informationstechnologie, commonName=BBAW-CA 1, emailAddress=ca@bbaw.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 26 | countryName=DE, organizationName=BESSY, organizationalUnitName=EDV, commonName=BESSY CA - G02, emailAddress=PKI@bessy.de | yes | expired | 2007-06-04 to 2019-06-03 | - | 1 | - | historical errors: 1 |
| 27 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Beuth Hochschule fuer Technik Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=Beuth Hochschule Berlin CA, emailAddress=pki@beuth-hochschule.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 28 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Beuth Hochschule fuer Technik Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=Beuth Hochschule Berlin CA, emailAddress=pki@beuth-hochschule.de | yes | expired | 2009-09-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 29 | countryName=DE, organizationName=Bundesinstitut fuer Risikobewertung, commonName=BfR CA, emailAddress=ca@bfr.bund.de | yes | expired | 2007-08-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 30 | countryName=DE, organizationName=Bundesinstitut fuer Risikobewertung, commonName=BfR CA, emailAddress=ca@bfr.bund.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 31 | countryName=DE, organizationName=Bundesanstalt f. Geowissenschaften u. Rohstoffe, organizationalUnitName=Zentrale Informationstechnik, commonName=bgr-ca | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 32 | countryName=DE, organizationName=Bundesanstalt f. Geowissenschaften u. Rohstoffe, organizationalUnitName=Zentrale Informationstechnik, commonName=bgr-ca | yes | expired | 2007-02-27 to 2019-02-26 | - | - | - | historical errors: 1 |
| 33 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Bischoeflich Muenstersches Offizialat, organizationalUnitName=IT, commonName=Bischoeflich Muenstersches Offizialat CA - G01, emailAddress=ca@bmo-vechta.de | yes | expired | 2011-10-04 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 34 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Bischoeflich Muenstersches Offizialat, organizationalUnitName=IT, commonName=Bischoeflich Muenstersches Offizialat CA - G01, emailAddress=ca@bmo-vechta.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 35 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Badische Landesbibliothek, organizationalUnitName=IT-Abteilung, commonName=BLB Karlsruhe CA, emailAddress=ca@blb-karlsruhe.de | yes | expired | 2008-04-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 36 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Badische Landesbibliothek, organizationalUnitName=IT-Abteilung, commonName=BLB Karlsruhe CA, emailAddress=ca@blb-karlsruhe.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 37 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Schwerin, organizationName=Ministerium fuer Bildung, Wissenschaft und Kultur M-V, organizationalUnitName=BMMV-PKI, commonName=BMMV CA - G 01, emailAddress=ca@kultus-mv.de | yes | expired | 2008-02-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 38 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Schwerin, organizationName=Ministerium fuer Bildung, Wissenschaft und Kultur M-V, organizationalUnitName=BMMV-PKI, commonName=BMMV CA - G 01, emailAddress=ca@kultus-mv.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 39 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bayerische Staatsbibliothek, commonName=BSB-CA, emailAddress=pki@bsb-muenchen.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 40 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bayerische Staatsbibliothek, commonName=BSB-CA, emailAddress=pki@bsb-muenchen.de | yes | expired | 2007-05-23 to 2019-05-22 | - | 1 | - | historical errors: 1 |
| 41 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Bundesamt fuer Seeschifffahrt und Hydrographie, organizationalUnitName=IT-Entwicklung Netze, commonName=BSH-CA, emailAddress=it-netzwerk@bsh.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 42 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Bundesamt fuer Seeschifffahrt und Hydrographie, organizationalUnitName=IT-Entwicklung Netze, commonName=BSH-CA, emailAddress=it-netzwerk@bsh.de | yes | expired | 2011-09-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 43 | countryName=DE, organizationName=Bibliotheksservice-Zentrum Baden-Wuerttemberg, commonName=BSZ-BW CA - G02, emailAddress=pki@bsz-bw.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 44 | countryName=DE, organizationName=Bibliotheksservice-Zentrum Baden-Wuerttemberg, commonName=BSZ-BW CA - G02, emailAddress=pki@bsz-bw.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 45 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Cottbus, organizationName=Brandenburgische Technische Universitaet Cottbus, organizationalUnitName=Rechenzentrum, commonName=BTU-CA (G01 2008), emailAddress=ca-btu@tu-cottbus.de | yes | expired | 2007-12-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 46 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Cottbus, organizationName=Brandenburgische Technische Universitaet Cottbus, organizationalUnitName=Rechenzentrum, commonName=BTU-CA (G01 2008), emailAddress=ca-btu@tu-cottbus.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 47 | countryName=DE, organizationName=Bauhaus-Universitaet Weimar, organizationalUnitName=SCC, commonName=BU Weimar CA - G02, emailAddress=pki@uni-weimar.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 48 | countryName=DE, organizationName=Bauhaus-Universitaet Weimar, organizationalUnitName=SCC, commonName=BU Weimar CA - G02, emailAddress=pki@uni-weimar.de | yes | expired | 2007-02-26 to 2019-02-25 | - | - | - | historical errors: 1 |
| 49 | countryName=DE, organizationName=Bundesamt fuer Kartographie und Geodaesie, commonName=Bundesamt fuer Kartographie und Geodaesie CA, emailAddress=pki@bkg.bund.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 50 | countryName=DE, organizationName=Bundesamt fuer Kartographie und Geodaesie, commonName=Bundesamt fuer Kartographie und Geodaesie CA, emailAddress=pki@bkg.bund.de | yes | expired | 2008-02-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 51 | countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 52 | countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de | yes | expired | 2010-01-11 to 2010-06-30 | - | 1 | - | historical errors: 1 |
| 53 | countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de | yes | expired | 2010-01-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 54 | countryName=DE, organizationName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), commonName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress=pki-dfn@baua.bund.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 55 | countryName=DE, organizationName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), commonName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress=pki-dfn@baua.bund.de | yes | expired | 2011-04-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 56 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Ilmenau, organizationName=Bundesanstalt fuer IT-Dienstleistungen, organizationalUnitName=DLZ-IT BMVBS, commonName=Bundesanstalt fuer IT-Dienstleistungen CA - G01 | yes | expired | 2014-05-06 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 57 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Ilmenau, organizationName=Bundesanstalt fuer IT-Dienstleistungen, organizationalUnitName=DLZ-IT BMVBS, commonName=Bundesanstalt fuer IT-Dienstleistungen CA - G01 | yes | expired | 2012-08-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | clean |
| 58 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bibliotheksverbund Bayern, commonName=BVB-CA, emailAddress=pki@bib-bvb.de | yes | expired | 2007-02-27 to 2019-02-26 | - | - | - | historical errors: 1 |
| 59 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bibliotheksverbund Bayern, commonName=BVB-CA, emailAddress=pki@bib-bvb.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 60 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, organizationalUnitName=Referat Z03, commonName=BVL CA, emailAddress=pki@bvl.bund.de | yes | expired | 2012-03-01 to 2019-06-30 | - | 1 | - | clean |
| 61 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, organizationalUnitName=Referat Z03, commonName=BVL CA, emailAddress=pki@bvl.bund.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 62 | countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=RRZN, commonName=CA der LUH (UH-CA) - G03 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 63 | countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=RRZN, commonName=CA der LUH (UH-CA) - G03 | yes | expired | 2007-03-27 to 2019-03-26 | - | - | - | historical errors: 1 |
| 64 | countryName=DE, organizationName=Universitaet Bielefeld, commonName=CA der Universitaet Bielefeld - G02, emailAddress=hrz-ra@uni-bielefeld.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 65 | countryName=DE, organizationName=Universitaet Bielefeld, commonName=CA der Universitaet Bielefeld - G02, emailAddress=hrz-ra@uni-bielefeld.de | yes | expired | 2007-01-29 to 2019-01-28 | - | - | - | historical errors: 1 |
| 66 | countryName=DE, organizationName=Universitaet zu Luebeck, organizationalUnitName=Institut fuer Medizinische Informatik, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de | yes | expired | 2007-03-15 to 2019-03-14 | - | - | - | historical errors: 1 |
| 67 | countryName=DE, organizationName=Universitaet zu Luebeck, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de | yes | expired | 2011-01-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 68 | countryName=DE, organizationName=Universitaet zu Luebeck, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 69 | countryName=DE, organizationName=Westfaelische Hochschule Gelsenkirchen, Bocholt, Recklinghausen, commonName=CA der Westfaelischen Hochschule - G01, emailAddress=ca@w-hs.de | yes | expired | 2014-09-23 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 70 | countryName=DE, stateOrProvinceName=Saarland, localityName=Saarbruecken, organizationName=Universitaet des Saarlandes, commonName=CA Universitaet des Saarlandes, emailAddress=ca@rz.uni-saarland.de | yes | expired | 2008-08-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 71 | countryName=DE, stateOrProvinceName=Saarland, localityName=Saarbruecken, organizationName=Universitaet des Saarlandes, commonName=CA Universitaet des Saarlandes, emailAddress=ca@rz.uni-saarland.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 72 | countryName=DE, organizationName=Campus Berlin-Buch, organizationalUnitName=Campus-IT, commonName=Campus Berlin-Buch CA - G02, emailAddress=ca@bbb-berlin.de | yes | expired | 2007-05-02 to 2019-05-01 | - | 1 | - | historical errors: 1 |
| 73 | countryName=DE, organizationName=Campus Berlin-Buch, organizationalUnitName=Campus-IT, commonName=Campus Berlin-Buch CA - G02, emailAddress=ca@bbb-berlin.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 74 | countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=ERP-Service, commonName=CCC LUH CA ERP-Service, emailAddress=ccc-luh-ca@ca.uni-hannover.de | yes | expired | 2013-06-18 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 75 | countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=ERP-Service, commonName=CCC LUH CA ERP-Service, emailAddress=ccc-luh-ca@ca.uni-hannover.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 76 | countryName=DE, organizationName=Charite - Universitaetsmedizin Berlin, organizationalUnitName=IT-Zentrum, commonName=Charite CA - G02, emailAddress=pki@charite.de | yes | expired | 2007-02-14 to 2019-02-13 | - | - | - | historical errors: 1 |
| 77 | countryName=DE, organizationName=Charite - Universitaetsmedizin Berlin, organizationalUnitName=IT-Zentrum, commonName=Charite CA - G02, emailAddress=pki@charite.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 78 | countryName=DE, organizationName=Clausthaler Umwelttechnik-Institut GmbH, commonName=CUTEC CA, emailAddress=ca@cutec.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 79 | countryName=DE, organizationName=Clausthaler Umwelttechnik-Institut GmbH, commonName=CUTEC CA, emailAddress=ca@cutec.de | yes | expired | 2011-09-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 80 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, commonName=DBFZ CA, emailAddress=pki@dbfz.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 81 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, commonName=DBFZ CA, emailAddress=pki@dbfz.de | yes | expired | 2010-02-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 82 | countryName=DE, organizationName=Deutsches Elektronen-Synchrotron DESY, organizationalUnitName=IT, commonName=DESY CA - G02, emailAddress=desy-ca@desy.de | yes | expired | 2007-02-26 to 2019-02-25 | - | - | - | historical errors: 1 |
| 83 | countryName=DE, organizationName=Deutsches Elektronen-Synchrotron DESY, organizationalUnitName=IT, commonName=DESY CA - G02, emailAddress=desy-ca@desy.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 84 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsche Kinemathek - Museum fuer Film und Fernsehen, organizationalUnitName=IT-Projekte, commonName=Deutsche Kinemathek CA, emailAddress=admin@deutsche-kinemathek.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 85 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsche Kinemathek - Museum fuer Film und Fernsehen, organizationalUnitName=IT-Projekte, commonName=Deutsche Kinemathek CA, emailAddress=admin@deutsche-kinemathek.de | yes | expired | 2011-10-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 86 | countryName=DE, organizationName=Deutsche Sporthochschule Koeln, organizationalUnitName=Informations- und Kommunikationstechnologiezentrum, commonName=Deutsche Sporthochschule Koeln - CA, emailAddress=iuk@dshs-koeln.de | yes | expired | 2012-05-30 to 2019-06-30 | - | 1 | - | clean |
| 87 | countryName=DE, organizationName=Deutsche Sporthochschule Koeln, organizationalUnitName=Informations- und Kommunikationstechnologiezentrum, commonName=Deutsche Sporthochschule Koeln - CA, emailAddress=iuk@dshs-koeln.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 88 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01 | yes | expired | 2011-04-14 to 2019-04-14 | 1.3.6.1.4.1.7879.13.26 | 0 | - | clean |
| 89 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01 | yes | revoked, expired | 2014-10-16 to 2019-07-09 | 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection | clean |
| 90 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01 | yes | revoked, expired | 2016-07-13 to 2026-07-13 | 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2 | 0 | E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5 | historical errors: 2 |
| 91 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA i01 | yes | revoked, expired | 2014-01-09 to 2019-07-09 | 1.3.6.1.4.1.7879.13.26 | 0 | - | clean |
| 92 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG secure email CA | yes | revoked | 2019-04-09 to 2029-04-09 | 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5 | historical errors: 2 |
| 93 | countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG secure email CA | yes | revoked | 2018-01-18 to 2028-01-18 | 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2 | 0 | E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5 | historical errors: 4 |
| 94 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E02 | yes | revoked | 2020-02-25 to 2030-02-25 | 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 95 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E03 | yes | current | 2020-07-09 to 2030-07-09 | 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5 | clean |
| 96 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E04 | yes | revoked | 2023-06-20 to 2028-06-19 | 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2 | 0 | E-mail Protection | clean |
| 97 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E05 | yes | current | 2023-08-09 to 2028-08-08 | 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5 | clean |
| 98 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG SMIME ECC CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection | current errors: 1 |
| 99 | countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG SMIME RSA CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26 | 0 | E-mail Protection | current errors: 1 |
| 100 | countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline@laboratories.telekom.de | yes | revoked, expired | 2007-07-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 101 | countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline.laboratories@telekom.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 102 | countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline.laboratories@telekom.de | yes | expired | 2007-07-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 103 | countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME ECC qualified CA 25 | yes | current | 2025-10-23 to 2035-10-22 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 104 | countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME qualified CA 25 | yes | current | 2025-10-23 to 2033-09-30 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 105 | countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME RSA qualified CA 25 | yes | current | 2025-10-23 to 2035-10-22 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 106 | countryName=DE, organizationName=Deutscher Bundestag, organizationalUnitName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G01, emailAddress=pki-ca@bundestag.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 107 | countryName=DE, organizationName=Deutscher Bundestag, organizationalUnitName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G01, emailAddress=pki-ca@bundestag.de | yes | expired | 2008-12-17 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 108 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G02 | yes | current | 2016-11-03 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 109 | countryName=DE, localityName=Offenbach am Main, organizationName=Deutscher Wetterdienst, organizationalUnitName=GB TI Ref. TI 16, commonName=Deutscher Wetterdienst CA - G01, emailAddress=dwd.webssl@dwd.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 110 | countryName=DE, localityName=Offenbach am Main, organizationName=Deutscher Wetterdienst, organizationalUnitName=GB TI Ref. TI 16, commonName=Deutscher Wetterdienst CA - G01, emailAddress=dwd.webssl@dwd.de | yes | expired | 2007-05-02 to 2019-05-01 | - | 1 | - | historical errors: 1 |
| 111 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Archaeologisches Institut, organizationalUnitName=IT, commonName=Deutsches Archaeologisches Institut - CA G01, emailAddress=pkica@dainst.de | yes | expired | 2010-03-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 112 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Archaeologisches Institut, organizationalUnitName=IT, commonName=Deutsches Archaeologisches Institut - CA G01, emailAddress=pkica@dainst.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 113 | countryName=DE, localityName=Berlin, organizationName=Deutsches Herzzentrum Berlin, organizationalUnitName=Informationstechnik, commonName=Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress=pki@dhzb.de | yes | expired | 2010-01-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 114 | countryName=DE, localityName=Berlin, organizationName=Deutsches Herzzentrum Berlin, organizationalUnitName=Informationstechnik, commonName=Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress=pki@dhzb.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 115 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Forschungsgemeinschaft e.V., organizationalUnitName=I-INF-1, commonName=DFG-CA, emailAddress=ca@dfg.de | yes | expired | 2009-05-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 116 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Forschungsgemeinschaft e.V., organizationalUnitName=I-INF-1, commonName=DFG-CA, emailAddress=ca@dfg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 117 | countryName=DE, organizationName=Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, organizationalUnitName=ISG, commonName=DFKI-CA - G01, emailAddress=ca@dfki.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 118 | countryName=DE, organizationName=Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, organizationalUnitName=ISG, commonName=DFKI-CA - G01, emailAddress=ca@dfki.de | yes | expired | 2013-09-11 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 119 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-CA Global | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 120 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-CA Global | yes | expired | 2011-04-01 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 121 | countryName=DE, organizationName=DFN-CERT Services GmbH, commonName=DFN-CERT Services GmbH CA - G02 | yes | expired | 2007-02-14 to 2019-02-13 | - | - | - | historical errors: 1 |
| 122 | countryName=DE, organizationName=DFN-CERT Services GmbH, commonName=DFN-CERT Services GmbH CA - G02 | yes | expired | 2014-03-25 to 2019-06-30 | 2.5.29.32.0 | 1 | - | clean |
| 123 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services | yes | expired | 2014-05-06 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 124 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services | yes | expired | 2007-01-03 to 2019-01-02 | - | - | - | historical errors: 1 |
| 125 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services Classic - G01 | yes | revoked, expired | 2007-01-03 to 2019-01-02 | - | - | - | historical errors: 1 |
| 126 | countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2 | yes | current | 2016-02-22 to 2031-02-22 | 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30, 2.23.140.1.2.2 | 2 | - | clean |
| 127 | countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Global Issuing CA | yes | current | 2016-05-24 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 128 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01 | yes | expired | 2014-07-22 to 2019-07-09 | 1.3.6.1.4.1.22177.300.1.1.4.2.2, 1.3.6.1.4.1.22177.300.1.1.4.3.0, 1.3.6.1.4.1.22177.300.1.1.4.3.1, 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30 | 2 | - | clean |
| 129 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01 | yes | expired | 2006-12-19 to 2019-06-30 | - | 2 | - | clean |
| 130 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01 | yes | revoked, expired | 2014-02-11 to 2019-07-09 | - | 2 | - | historical errors: 1 |
| 131 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA | yes | revoked, expired | 2007-01-08 to 2018-11-30 | - | - | - | historical errors: 1 |
| 132 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA, emailAddress=ca@dfn.de | yes | revoked, expired | 2007-01-09 to 2018-11-30 | - | - | - | historical errors: 1 |
| 133 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA - G02 | yes | expired | 2014-05-06 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 134 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA - G02 | yes | expired | 2007-01-17 to 2018-11-30 | - | - | - | historical errors: 1 |
| 135 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca@winshuttle.de | yes | revoked, expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 136 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca@winshuttle.de | yes | revoked, expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 137 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca-winshuttle@dfn.de | yes | expired | 2014-05-19 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 138 | countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca-winshuttle@dfn.de | yes | expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 139 | countryName=DE, organizationName=Duale Hochschule Baden-Wuerttemberg, commonName=DHBW CA - G01, emailAddress=pki@dhbw-vs.de | yes | expired | 2010-02-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 140 | countryName=DE, organizationName=Duale Hochschule Baden-Wuerttemberg, commonName=DHBW CA - G01, emailAddress=pki@dhbw-vs.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 141 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Nuthetal, organizationName=Deutsches Institut fuer Ernaehrungsforschung (DIfE), organizationalUnitName=IT, commonName=DIfE CA, emailAddress=ra@dife.de | yes | expired | 2007-06-20 to 2019-06-19 | - | 1 | - | historical errors: 1 |
| 142 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Nuthetal, organizationName=Deutsches Institut fuer Ernaehrungsforschung (DIfE), organizationalUnitName=IT, commonName=DIfE CA, emailAddress=ra@dife.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 143 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Institut fuer Urbanistik (Difu), commonName=Difu CA, emailAddress=ca@difu.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 144 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Institut fuer Urbanistik (Difu), commonName=Difu CA, emailAddress=ca@difu.de | yes | expired | 2008-06-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 145 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Deutsches Institut f. Medizinische Dokumentation und Information, commonName=DIMDI CA - G01, emailAddress=ca@dimdi.de | yes | expired | 2015-03-24 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 146 | countryName=DE, organizationName=Deutsches Institut fuer Internationale Paedagogische Forschung, commonName=DIPF CA - G02, emailAddress=ca@dipf.de | yes | expired | 2008-01-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 147 | countryName=DE, organizationName=Deutsches Institut fuer Internationale Paedagogische Forschung, commonName=DIPF CA - G02, emailAddress=ca@dipf.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 148 | countryName=DE, organizationName=Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), organizationalUnitName=IT, commonName=DIW Berlin CA, emailAddress=diw-ca@diw.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 149 | countryName=DE, organizationName=Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), organizationalUnitName=IT, commonName=DIW Berlin CA, emailAddress=diw-ca@diw.de | yes | expired | 2009-03-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 150 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA | yes | revoked, expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 151 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA, emailAddress=dfnpki@dkfz.de | yes | expired | 2014-05-19 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 152 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA, emailAddress=dfnpki@dkfz.de | yes | expired | 2007-04-11 to 2019-04-09 | - | - | - | historical errors: 1 |
| 153 | countryName=DE, organizationName=Deutsches Klimarechenzentrum GmbH, commonName=DKRZ CA - G02, emailAddress=pki@dkrz.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 154 | countryName=DE, organizationName=Deutsches Klimarechenzentrum GmbH, commonName=DKRZ CA - G02, emailAddress=pki@dkrz.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 155 | countryName=DE, organizationName=Deutsche Schillergesellschaft e. V., organizationalUnitName=Deutsches Literaturarchiv Marbach, commonName=DLA Marbach CA - G01 | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 156 | countryName=DE, organizationName=Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), commonName=DLR CA - G02, emailAddress=ca@dlr.de | yes | expired | 2014-08-28 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 157 | countryName=DE, organizationName=Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), commonName=DLR CA - G02, emailAddress=ca@dlr.de | yes | expired | 2007-01-31 to 2019-01-30 | - | - | - | historical errors: 1 |
| 158 | countryName=DE, localityName=Frankfurt am Main, organizationName=Deutsche Nationalbibliothek, commonName=DNB-CA, emailAddress=ca@d-nb.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 159 | countryName=DE, localityName=Frankfurt am Main, organizationName=Deutsche Nationalbibliothek, commonName=DNB-CA, emailAddress=ca@d-nb.de | yes | expired | 2007-11-14 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 160 | countryName=DE, organizationName=Dioezese Rottenburg-Stuttgart, commonName=DRS CA - G01, emailAddress=pki@drs.de | yes | expired | 2008-08-22 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 161 | countryName=DE, organizationName=Dioezese Rottenburg-Stuttgart, commonName=DRS CA - G01, emailAddress=pki@drs.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 162 | countryName=DE, organizationName=Ernst-Abbe-Hochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=EAH-CA - G01, emailAddress=pki@eah-jena.de | yes | expired | 2014-12-09 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 163 | countryName=DE, organizationName=Universitaet Greifswald, organizationalUnitName=Rechenzentrum, commonName=Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress=ugca@uni-greifswald.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 164 | countryName=DE, organizationName=Universitaet Greifswald, organizationalUnitName=Rechenzentrum, commonName=Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress=ugca@uni-greifswald.de | yes | expired | 2007-02-14 to 2019-02-13 | - | - | - | historical errors: 1 |
| 165 | countryName=DE, organizationName=ESO - European Organisation for Astronomical Research, organizationalUnitName=TEC, commonName=ESO PKI - G02, emailAddress=trustmaster@eso.org | yes | expired | 2007-01-29 to 2019-01-28 | - | - | - | historical errors: 1 |
| 166 | countryName=DE, organizationName=ESO - European Organisation for Astronomical Research, organizationalUnitName=TEC, commonName=ESO PKI - G02, emailAddress=trustmaster@eso.org | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 167 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Frankfurt (Oder), organizationName=Europa-Universitaet Viadrina Frankfurt (Oder), commonName=Europa-Universitaet Viadrina CA, emailAddress=pki@europa-uni.de | yes | expired | 2010-07-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 168 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Frankfurt (Oder), organizationName=Europa-Universitaet Viadrina Frankfurt (Oder), commonName=Europa-Universitaet Viadrina CA, emailAddress=pki@europa-uni.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 169 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Evangelische Fachhochschule Rheinland-Westfalen-Lippe, organizationalUnitName=HRZ, commonName=Evangelische Fachhochschule RWL CA - G01, emailAddress=pki@efh-bochum.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 170 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Evangelische Fachhochschule Rheinland-Westfalen-Lippe, organizationalUnitName=HRZ, commonName=Evangelische Fachhochschule RWL CA - G01, emailAddress=pki@efh-bochum.de | yes | expired | 2009-04-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 171 | countryName=DE, stateOrProvinceName=Bayern, localityName=Nuernberg, organizationName=Evangelische Hochschule Nuernberg, commonName=EVHN CA - G01, emailAddress=ca@evhn.de | yes | expired | 2014-07-11 to 2019-07-06 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 172 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Filmakademie Baden-Wuerttemberg GmbH, organizationalUnitName=IT OfficeNet, commonName=FA Ludwigsburg CA, emailAddress=ca-falu@filmakademie.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 173 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Filmakademie Baden-Wuerttemberg GmbH, organizationalUnitName=IT OfficeNet, commonName=FA Ludwigsburg CA, emailAddress=ca-falu@filmakademie.de | yes | expired | 2010-05-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 174 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Aachen, organizationName=Fachhochschule Aachen, organizationalUnitName=DVZ, commonName=Fachhochschule Aachen CA - G01, emailAddress=PKI@fh-aachen.de | yes | expired | 2008-04-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 175 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Aachen, organizationName=Fachhochschule Aachen, organizationalUnitName=DVZ, commonName=Fachhochschule Aachen CA - G01, emailAddress=PKI@fh-aachen.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 176 | countryName=DE, stateOrProvinceName=Bayern, localityName=Aschaffenburg, organizationName=Fachhochschule Aschaffenburg, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Aschaffenburg, emailAddress=pki2@fh-aschaffenburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 177 | countryName=DE, stateOrProvinceName=Bayern, localityName=Aschaffenburg, organizationName=Fachhochschule Aschaffenburg, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Aschaffenburg, emailAddress=pki2@fh-aschaffenburg.de | yes | expired | 2007-12-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 178 | countryName=DE, organizationName=Fachhochschule Bielefeld, commonName=Fachhochschule Bielefeld | yes | expired | 2007-01-25 to 2019-01-15 | - | - | - | historical errors: 1 |
| 179 | countryName=DE, organizationName=Fachhochschule Bielefeld, commonName=Fachhochschule Bielefeld | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 180 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Fachhochschule Bonn-Rhein-Sieg, commonName=Fachhochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@fh-brs.de | yes | expired | 2008-10-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 181 | countryName=DE, organizationName=Fachhochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Fachhochschule fuer Technik und Wirtschaft Berlin - G02, emailAddress=ca@fhtw-berlin.de | yes | expired | 2007-01-29 to 2019-01-28 | - | - | - | historical errors: 1 |
| 182 | countryName=DE, organizationName=Fachhochschule Giessen-Friedberg, commonName=Fachhochschule Giessen-Friedberg CA - G02, emailAddress=pki-gifb@fh-giessen.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 183 | countryName=DE, organizationName=Fachhochschule Giessen-Friedberg, commonName=Fachhochschule Giessen-Friedberg CA - G02, emailAddress=pki-gifb@fh-giessen.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 184 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Fachhochschule Hannover, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Hannover CA, emailAddress=pki@fh-hannover.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 185 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Fachhochschule Hannover, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Hannover CA, emailAddress=pki@fh-hannover.de | yes | expired | 2007-07-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 186 | countryName=DE, organizationName=Fachhochschule Kiel, commonName=Fachhochschule Kiel, emailAddress=ca@fh-kiel.de | yes | expired | 2007-03-08 to 2019-03-07 | - | - | - | historical errors: 1 |
| 187 | countryName=DE, organizationName=Fachhochschule Kiel, commonName=Fachhochschule Kiel, emailAddress=ca@fh-kiel.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 188 | countryName=DE, localityName=Landshut, organizationName=Fachhochschule Landshut, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Landshut CA - G01, emailAddress=ca@fh-landshut.de | yes | expired | 2007-01-31 to 2019-01-30 | - | - | - | historical errors: 1 |
| 189 | countryName=DE, localityName=Landshut, organizationName=Fachhochschule Landshut, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Landshut CA - G01, emailAddress=ca@fh-landshut.de | yes | expired | 2014-08-28 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 190 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Fachhochschule Luebeck, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Luebeck CA - G01, emailAddress=ca@fh-luebeck.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 191 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Fachhochschule Luebeck, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Luebeck CA - G01, emailAddress=ca@fh-luebeck.de | yes | expired | 2010-02-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 192 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Nordhausen, organizationName=Fachhochschule Nordhausen, commonName=Fachhochschule Nordhausen CA - G01, emailAddress=pki@fh-nordhausen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 193 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Nordhausen, organizationName=Fachhochschule Nordhausen, commonName=Fachhochschule Nordhausen CA - G01, emailAddress=pki@fh-nordhausen.de | yes | expired | 2010-08-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 194 | countryName=DE, organizationName=Fachhochschule Schmalkalden, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Schmalkalden CA - G01, emailAddress=pki@fh-schmalkalden.de | yes | expired | 2010-06-22 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 195 | countryName=DE, organizationName=Fachhochschule Schmalkalden, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Schmalkalden CA - G01, emailAddress=pki@fh-schmalkalden.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 196 | countryName=DE, organizationName=Fachhochschule Wuerzburg-Schweinfurt, commonName=Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress=ca@fh-sw.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 197 | countryName=DE, organizationName=Fachhochschule Wuerzburg-Schweinfurt, commonName=Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress=ca@fh-sw.de | yes | expired | 2008-01-11 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 198 | countryName=DE, stateOrProvinceName=Bayern, localityName=Erlangen, organizationName=Universitaet Erlangen-Nuernberg, organizationalUnitName=RRZE, commonName=FAU-CA, emailAddress=ca@rrze.uni-erlangen.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 199 | countryName=DE, stateOrProvinceName=Bayern, localityName=Erlangen, organizationName=Universitaet Erlangen-Nuernberg, organizationalUnitName=RRZE, commonName=FAU-CA, emailAddress=ca@rrze.uni-erlangen.de | yes | expired | 2007-07-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 200 | countryName=DE, organizationName=FIZ CHEMIE Berlin GmbH, commonName=FCH CA - G02, emailAddress=fch-ca@fiz-chemie.de | yes | revoked, expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 201 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hagen, organizationName=FernUniversitaet in Hagen, organizationalUnitName=Zentrum fuer Medien und IT, commonName=FernUniversitaet in Hagen Global CA, emailAddress=caadmin@fernuni-hagen.de | yes | expired | 2009-06-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 202 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hagen, organizationName=FernUniversitaet in Hagen, organizationalUnitName=Zentrum fuer Medien und IT, commonName=FernUniversitaet in Hagen Global CA, emailAddress=caadmin@fernuni-hagen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 203 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Fachhochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=FH Ansbach CA, emailAddress=ca@fh-ansbach.de | yes | expired | 2007-08-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 204 | countryName=DE, organizationName=Fachhochschule Augsburg, organizationalUnitName=Rechenzentrum, commonName=FH Augsburg CA - G02, emailAddress=ca@fh-augsburg.de | yes | expired | 2007-03-14 to 2019-03-13 | - | - | - | historical errors: 1 |
| 205 | countryName=DE, organizationName=Fachhochschule Augsburg, organizationalUnitName=Rechenzentrum, commonName=FH Augsburg CA - G02, emailAddress=ca@fh-augsburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 206 | countryName=DE, organizationName=Fachhochschule fuer oeffentliche Verwaltung Nordrhein-Westfalen, commonName=FH fuer oeffentliche Verwaltung NRW CA - G01, emailAddress=ca@fhoev.nrw.de | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 207 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Fachhochschule Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=FH Ingolstadt CA - G01, emailAddress=pki@fh-ingolstadt.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 208 | countryName=DE, organizationName=Fachhochschule Koeln, commonName=FH Koeln CA - G01, emailAddress=ca@fh-koeln.de | yes | expired | 2012-10-26 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 209 | countryName=DE, organizationName=Fachhochschule Koeln, commonName=FH Koeln CA - G01, emailAddress=ca@fh-koeln.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 210 | countryName=DE, organizationName=Fachhochschule Lippe und Hoexter, commonName=FH LuH CA - G02, emailAddress=ca@fh-luh.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 211 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muenster, organizationName=Fachhochschule Muenster, organizationalUnitName=Datenverarbeitungszentrale, commonName=FH Muenster CA - G01, emailAddress=ca@fh-muenster.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 212 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muenster, organizationName=Fachhochschule Muenster, organizationalUnitName=Datenverarbeitungszentrale, commonName=FH Muenster CA - G01, emailAddress=ca@fh-muenster.de | yes | expired | 2007-12-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 213 | countryName=DE, organizationName=Fachhochschule Neu-Ulm, organizationalUnitName=Rechenzentrum, commonName=FH Neu-Ulm CA - G01, emailAddress=pki@fh-neu-ulm.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 214 | countryName=DE, organizationName=Fachhochschule Neu-Ulm, organizationalUnitName=Rechenzentrum, commonName=FH Neu-Ulm CA - G01, emailAddress=pki@fh-neu-ulm.de | yes | expired | 2007-07-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 215 | countryName=DE, organizationName=Fachhochschule Osnabrueck, organizationalUnitName=Fachdienst EDV, commonName=FH Osnabrueck CA - G02, emailAddress=certificate@fh-osnabrueck.de | yes | expired | 2007-03-27 to 2019-03-26 | - | - | - | historical errors: 1 |
| 216 | countryName=DE, organizationName=Fachhochschule Potsdam, commonName=FH Potsdam CA - G01, emailAddress=ca@fh-potsdam.de | yes | expired | 2014-06-27 to 2019-07-06 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 217 | countryName=DE, organizationName=Fachhochschule Regensburg, commonName=FH Regensburg CA, emailAddress=pki@fh-regensburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 218 | countryName=DE, organizationName=Fachhochschule Regensburg, commonName=FH Regensburg CA, emailAddress=pki@fh-regensburg.de | yes | expired | 2007-10-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 219 | countryName=DE, organizationName=Fachhochschule Stralsund, organizationalUnitName=ZIK, commonName=FH Stralsund CA - G02, emailAddress=ca@fh-stralsund.de | yes | expired | 2007-02-01 to 2019-01-31 | - | - | - | historical errors: 1 |
| 220 | countryName=DE, organizationName=Fachhochschule Stralsund, organizationalUnitName=ZIK, commonName=FH Stralsund CA - G02, emailAddress=ca@fh-stralsund.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 221 | countryName=DE, stateOrProvinceName=Bayern, localityName=Coburg, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, commonName=FH-Coburg CA, emailAddress=fhc-pki@fh-coburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 222 | countryName=DE, stateOrProvinceName=Bayern, localityName=Coburg, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, commonName=FH-Coburg CA, emailAddress=fhc-pki@fh-coburg.de | yes | expired | 2007-05-02 to 2019-05-01 | - | 1 | - | historical errors: 1 |
| 223 | countryName=DE, organizationName=Fachhochschule Emden/Leer, commonName=FH-EL CA, emailAddress=pki@fh-el.de | yes | expired | 2010-03-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 224 | countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de | yes | revoked, expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 225 | countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 226 | countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de | yes | expired | 2007-02-19 to 2019-02-18 | - | 1 | - | historical errors: 1 |
| 227 | countryName=DE, organizationName=Fachhochschule Flensburg, organizationalUnitName=IT Dezernat, commonName=FH-Flensburg CA - G02, emailAddress=postmaster@fh-flensburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 228 | countryName=DE, organizationName=Fachhochschule Flensburg, organizationalUnitName=IT Dezernat, commonName=FH-Flensburg CA - G02, emailAddress=postmaster@fh-flensburg.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 229 | countryName=DE, organizationName=Fachhochschule Frankfurt am Main, commonName=FH-Frankfurt a.M. - CA, emailAddress=ca@dv.fh-frankfurt.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 230 | countryName=DE, organizationName=Fachhochschule Frankfurt am Main, commonName=FH-Frankfurt a.M. - CA, emailAddress=ca@dv.fh-frankfurt.de | yes | expired | 2007-03-28 to 2019-03-27 | - | - | - | historical errors: 1 |
| 231 | countryName=DE, organizationName=Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-OOW CA - G02, emailAddress=pki@fh-oow.de | yes | revoked, expired | 2007-02-01 to 2019-01-31 | - | - | - | historical errors: 1 |
| 232 | countryName=DE, organizationName=Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-OOW CA - G02, emailAddress=pki@fh-oow.de | yes | expired | 2007-04-16 to 2019-04-15 | - | 1 | - | historical errors: 1 |
| 233 | countryName=DE, organizationName=Fachhochschule Rosenheim, organizationalUnitName=Rechenzentrum, commonName=FH-RO CA - G02 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 234 | countryName=DE, organizationName=Fachhochschule Rosenheim, organizationalUnitName=Rechenzentrum, commonName=FH-RO CA - G02 | yes | expired | 2007-03-14 to 2019-03-13 | - | - | - | historical errors: 1 |
| 235 | countryName=DE, organizationName=Fachhochschule Suedwestfalen, commonName=FH-SWF CA, emailAddress=pki@fh-swf.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 236 | countryName=DE, organizationName=Fachhochschule Suedwestfalen, commonName=FH-SWF CA, emailAddress=pki@fh-swf.de | yes | expired | 2007-03-15 to 2019-03-14 | - | - | - | historical errors: 1 |
| 237 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Heide, organizationName=Fachhochschule Westkueste, organizationalUnitName=EDV Abteilung, commonName=FH-Westkueste CA, emailAddress=ca@fh-westkueste.de | yes | expired | 2010-02-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 238 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Heide, organizationName=Fachhochschule Westkueste, organizationalUnitName=EDV Abteilung, commonName=FH-Westkueste CA, emailAddress=ca@fh-westkueste.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 239 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Brandenburg an der Havel, organizationName=Fachhochschule Brandenburg, organizationalUnitName=ZIMK/Rechenzentrum, commonName=FHB-CA, emailAddress=fhb-ca@fh-brandenburg.de | yes | expired | 2008-07-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 240 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Brandenburg an der Havel, organizationName=Fachhochschule Brandenburg, organizationalUnitName=ZIMK/Rechenzentrum, commonName=FHB-CA, emailAddress=fhb-ca@fh-brandenburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 241 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-CA Global - G01 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 242 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-CA Global - G01 | yes | expired | 2007-03-20 to 2019-03-19 | - | - | - | historical errors: 1 |
| 243 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-Chipcard CA | yes | expired | 2009-09-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 244 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-Chipcard CA | yes | expired | 2015-11-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 245 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Gelsenkirchen, organizationName=Fachhochschule Gelsenkirchen, organizationalUnitName=ZIM-IT, commonName=FHGE CA - G01, emailAddress=pki@fh-gelsenkirchen.de | yes | expired | 2009-06-29 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 246 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Gelsenkirchen, organizationName=Fachhochschule Gelsenkirchen, organizationalUnitName=ZIM-IT, commonName=FHGE CA - G01, emailAddress=pki@fh-gelsenkirchen.de | yes | expired | 2015-11-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 247 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Fachhochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=FHJ CA - G01, emailAddress=pki@fh-jena.de | yes | expired | 2007-07-06 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 248 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Fachhochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=FHJ CA - G01, emailAddress=pki@fh-jena.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 249 | countryName=DE, stateOrProvinceName=Berlin, organizationName=Fachhochschule fuer Wirtschaft Berlin, commonName=FHW Berlin CA, emailAddress=pki@fhw-berlin.de | yes | expired | 2008-02-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 250 | countryName=DE, stateOrProvinceName=Bayern, organizationName=Fachhochschule Weihenstephan, commonName=FHW CA - G01, emailAddress=pki@fh-weihenstephan.de | yes | expired | 2008-04-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 251 | countryName=DE, stateOrProvinceName=Bayern, organizationName=Fachhochschule Weihenstephan, commonName=FHW CA - G01, emailAddress=pki@fh-weihenstephan.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 252 | countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Fachhochschule Wiesbaden, organizationalUnitName=IT-Center, commonName=FHW-CA, emailAddress=fhw-ca@itc.fh-wiesbaden.de | yes | expired | 2008-05-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 253 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Wolfenbuettel, organizationName=Fachhochschule Braunschweig/Wolfenbuettel, organizationalUnitName=Rechenzentrum, commonName=FHWF-CA, emailAddress=pki@fh-wolfenbuettel.de | yes | expired | 2007-10-17 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 254 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Wolfenbuettel, organizationName=Fachhochschule Braunschweig/Wolfenbuettel, organizationalUnitName=Rechenzentrum, commonName=FHWF-CA, emailAddress=pki@fh-wolfenbuettel.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 255 | countryName=DE, organizationName=Friedrich-Loeffler-Institut, commonName=FLI CA, emailAddress=pki@fli.bund.de | yes | expired | 2007-12-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 256 | countryName=DE, organizationName=Friedrich-Loeffler-Institut, commonName=FLI CA, emailAddress=pki@fli.bund.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 257 | countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Root CA 2007 | yes | revoked, expired | 2007-12-05 to 2019-06-30 | - | 1 | - | clean |
| 258 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G01, emailAddress=pki@fraunhofer.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 259 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G01, emailAddress=pki@fraunhofer.de | yes | expired | 2012-05-04 to 2019-06-30 | - | 1 | - | clean |
| 260 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G02 | yes | current | 2016-05-24 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 261 | countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA 2007 | yes | revoked, expired | 2008-04-28 to 2019-06-30 | - | 0 | - | clean |
| 262 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA - G01 | yes | expired | 2014-05-12 to 2019-07-06 | 2.5.29.32.0 | 1 | - | clean |
| 263 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA - G02 | yes | current | 2016-05-24 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 264 | countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA 2007 | yes | revoked, expired | 2007-12-12 to 2019-06-30 | - | 0 | - | clean |
| 265 | countryName=DE, organizationName=Freie Hansestadt Bremen, commonName=Freie Hansestadt Bremen CA - G01, emailAddress=ca@bildung.bremen.de | yes | expired | 2012-12-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 266 | countryName=DE, organizationName=Freie Hansestadt Bremen, commonName=Freie Hansestadt Bremen CA - G01, emailAddress=ca@bildung.bremen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 267 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Freie Universitaet Berlin, organizationalUnitName=ZEDAT, commonName=Freie Universitaet Berlin - FU-CA - G01, emailAddress=ca@FU-Berlin.DE | yes | expired | 2007-01-17 to 2019-01-15 | - | - | - | historical errors: 1 |
| 268 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Freie Universitaet Berlin, organizationalUnitName=ZEDAT, commonName=Freie Universitaet Berlin - FU-CA - G01, emailAddress=ca@FU-Berlin.DE | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 269 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Fritz-Haber-Institut der Max-Planck-Gesellschaft, organizationalUnitName=PPB, commonName=Fritz-Haber-Institut CA, emailAddress=pki@fhi-berlin.mpg.de | yes | expired | 2008-12-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 270 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Fritz-Haber-Institut der Max-Planck-Gesellschaft, organizationalUnitName=PPB, commonName=Fritz-Haber-Institut CA, emailAddress=pki@fhi-berlin.mpg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 271 | countryName=DE, organizationName=Forschungsverbund Berlin e.V., organizationalUnitName=Corporate Network, commonName=FV Berlin - PKI CA, emailAddress=pki-ca@fv-berlin.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 272 | countryName=DE, organizationName=Forschungsverbund Berlin e.V., organizationalUnitName=Corporate Network, commonName=FV Berlin - PKI CA, emailAddress=pki-ca@fv-berlin.de | yes | expired | 2007-07-12 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 273 | countryName=DE, organizationName=FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, organizationalUnitName=Netzzentrum, commonName=FZ-Borstel-CA - G01, emailAddress=ca@fz-borstel.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 274 | countryName=DE, organizationName=FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, organizationalUnitName=Netzzentrum, commonName=FZ-Borstel-CA - G01, emailAddress=ca@fz-borstel.de | yes | expired | 2013-09-11 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 275 | countryName=DE, organizationName=Forschungszentrum Dresden-Rossendorf e.V., organizationalUnitName=Informationstechnologie, commonName=FZD-CA - G02, emailAddress=ra@fzd.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 276 | countryName=DE, organizationName=Forschungszentrum Dresden-Rossendorf e.V., organizationalUnitName=Informationstechnologie, commonName=FZD-CA - G02, emailAddress=ra@fzd.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 277 | countryName=DE, organizationName=FZI Forschungszentrum Informatik, commonName=FZI CA - G01, emailAddress=ca@fzi.de | yes | expired | 2014-10-28 to 2019-07-09 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 278 | countryName=DE, organizationName=Forschungszentrum Juelich GmbH, commonName=FZJ Certification Authority - G02, emailAddress=ca@fz-juelich.de | yes | expired | 2007-12-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 279 | countryName=DE, organizationName=Forschungszentrum Juelich GmbH, commonName=FZJ Certification Authority - G02, emailAddress=ca@fz-juelich.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 280 | countryName=DE, organizationName=Georg-Eckert-Institut fuer internationale Schulbuchforschung, commonName=GEI CA - G01, emailAddress=ca@gei.de | yes | expired | 2012-11-07 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 281 | countryName=DE, organizationName=Georg-Eckert-Institut fuer internationale Schulbuchforschung, commonName=GEI CA - G01, emailAddress=ca@gei.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 282 | countryName=DE, organizationName=GeoForschungsZentrum Potsdam, commonName=GeoForschungsZentrum Potsdam CA - G01, emailAddress=pki@gfz-potsdam.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 283 | countryName=DE, organizationName=GeoForschungsZentrum Potsdam, commonName=GeoForschungsZentrum Potsdam CA - G01, emailAddress=pki@gfz-potsdam.de | yes | expired | 2007-03-29 to 2019-03-28 | - | - | - | historical errors: 1 |
| 284 | countryName=DE, organizationName=Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), commonName=GEOMAR CA - G02, emailAddress=ca@geomar.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 285 | countryName=DE, organizationName=Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), commonName=GEOMAR CA - G02, emailAddress=ca@geomar.de | yes | expired | 2011-09-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 286 | countryName=DE, organizationName=GESIS, organizationalUnitName=IT, commonName=GESIS-CA, emailAddress=gesis-ca@gesis.org | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 287 | countryName=DE, organizationName=GESIS, organizationalUnitName=IT, commonName=GESIS-CA, emailAddress=gesis-ca@gesis.org | yes | expired | 2008-07-28 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 288 | countryName=DE, organizationName=GKSS Forschungszentrum, commonName=GKSS-CA G02 | yes | expired | 2008-06-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 289 | countryName=DE, organizationName=Universitaet Ulm, commonName=Global-Uni-Ulm-CA, emailAddress=ca@uni-ulm.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 290 | countryName=DE, organizationName=Universitaet Ulm, commonName=Global-Uni-Ulm-CA, emailAddress=ca@uni-ulm.de | yes | expired | 2009-11-30 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 291 | countryName=DE, organizationName=Universitaet Tuebingen, commonName=Global-UNITUE-CA 01, emailAddress=unitue-ca@uni-tuebingen.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 292 | countryName=DE, organizationName=Universitaet Tuebingen, commonName=Global-UNITUE-CA 01, emailAddress=unitue-ca@uni-tuebingen.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 293 | countryName=DE, organizationName=Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, commonName=GRS CA, emailAddress=pki@grs.de | yes | expired | 2011-04-01 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 294 | countryName=DE, organizationName=Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, commonName=GRS CA, emailAddress=pki@grs.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 295 | countryName=DE, organizationName=Gesellschaft fuer Schwerionenforschung mbH (GSI), organizationalUnitName=GF/W, commonName=GSI CA 02, emailAddress=pki@gsi.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 296 | countryName=DE, organizationName=Gesellschaft fuer Schwerionenforschung mbH (GSI), organizationalUnitName=GF/W, commonName=GSI CA 02, emailAddress=pki@gsi.de | yes | expired | 2008-02-28 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 297 | countryName=DE, stateOrProvinceName=NIEDERSACHSEN, localityName=GOETTINGEN, organizationName=Gesellschaft fuer wissenschaftliche Datenverarbeitung, organizationalUnitName=GWDG, commonName=GWDG CA, emailAddress=gwdg-ca@gwdg.de | yes | expired | 2007-02-28 to 2019-02-27 | - | - | - | historical errors: 1 |
| 298 | countryName=DE, stateOrProvinceName=NIEDERSACHSEN, localityName=GOETTINGEN, organizationName=Gesellschaft fuer wissenschaftliche Datenverarbeitung, organizationalUnitName=GWDG, commonName=GWDG CA, emailAddress=gwdg-ca@gwdg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 299 | countryName=DE, organizationName=Herzog August Bibliothek Wolfenbuettel, commonName=HAB CA - G01, emailAddress=ca@hab.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 300 | countryName=DE, organizationName=Herzog August Bibliothek Wolfenbuettel, commonName=HAB CA - G01, emailAddress=ca@hab.de | yes | expired | 2012-12-13 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 301 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=HafenCity Universitaet Hamburg, commonName=HafenCity Universitaet Hamburg CA - G01, emailAddress=pki@hcu-hamburg.de | yes | expired | 2007-12-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 302 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=HafenCity Universitaet Hamburg, commonName=HafenCity Universitaet Hamburg CA - G01, emailAddress=pki@hcu-hamburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 303 | countryName=DE, organizationName=Hochschule fuer Angewandte Wissenschaften Hamburg, commonName=HAW Hamburg CA - G02 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 304 | countryName=DE, organizationName=Hochschule fuer Angewandte Wissenschaften Hamburg, commonName=HAW Hamburg CA - G02 | yes | expired | 2007-01-29 to 2019-01-28 | - | - | - | historical errors: 1 |
| 305 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Hochschule fuer angewandte Wissenschaften FH Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=HAW Ingolstadt CA - G01, emailAddress=pki@haw-ingolstadt.de | yes | expired | 2010-02-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 306 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Hochschule fuer angewandte Wissenschaften FH Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=HAW Ingolstadt CA - G01, emailAddress=pki@haw-ingolstadt.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 307 | countryName=DE, stateOrProvinceName=Bayern, localityName=Amberg, organizationName=Hochschule Amberg-Weiden, organizationalUnitName=Rechenzentrum, commonName=HAW-CA, emailAddress=ca@haw-aw.de | yes | expired | 2009-10-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 308 | countryName=DE, stateOrProvinceName=Bayern, localityName=Amberg, organizationName=Hochschule Amberg-Weiden, organizationalUnitName=Rechenzentrum, commonName=HAW-CA, emailAddress=ca@haw-aw.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 309 | countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de | yes | expired | 2007-02-05 to 2019-02-04 | - | 1 | - | historical errors: 1 |
| 310 | countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de | yes | revoked, expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 311 | countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de | yes | expired | 2007-02-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 312 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Biberach, organizationName=Hochschule Biberach, organizationalUnitName=Rechenzentrum, commonName=HBC-Global CA - G 01, emailAddress=pki@fh-biberach.de | yes | expired | 2008-04-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 313 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Biberach, organizationName=Hochschule Biberach, organizationalUnitName=Rechenzentrum, commonName=HBC-Global CA - G 01, emailAddress=pki@fh-biberach.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 314 | countryName=DE, organizationName=Hochschulbibliothekszentrum NRW, organizationalUnitName=Rechenzentrum, commonName=hbz NRW CA - G02, emailAddress=pki@hbz-nrw.de | yes | expired | 2007-06-19 to 2019-06-18 | - | 1 | - | historical errors: 1 |
| 315 | countryName=DE, organizationName=Hochschulbibliothekszentrum NRW, organizationalUnitName=Rechenzentrum, commonName=hbz NRW CA - G02, emailAddress=pki@hbz-nrw.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 316 | countryName=DE, organizationName=Hochschule Esslingen, organizationalUnitName=Rechenzentrum, commonName=HE CA - G02 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 317 | countryName=DE, organizationName=Hochschule Esslingen, organizationalUnitName=Rechenzentrum, commonName=HE CA - G02 | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 318 | countryName=DE, stateOrProvinceName=Bayern, localityName=Oberschleissheim-Neuherberg, organizationName=Helmholtz Zentrum Muenchen, organizationalUnitName=Rechenzentrum, commonName=Helmholtz Zentrum Muenchen CA - G01, emailAddress=pki@helmholtz-muenchen.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 319 | countryName=DE, stateOrProvinceName=Bayern, localityName=Oberschleissheim-Neuherberg, organizationName=Helmholtz Zentrum Muenchen, organizationalUnitName=Rechenzentrum, commonName=Helmholtz Zentrum Muenchen CA - G01, emailAddress=pki@helmholtz-muenchen.de | yes | expired | 2008-01-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 320 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Helmholtz-Zentrum fuer Infektionsforschung GmbH, organizationalUnitName=Rechenzentrum, commonName=Helmholtz-Zentrum fuer Infektionsforschung, emailAddress=sysadmin@helmholtz-hzi.de | yes | expired | 2007-06-28 to 2019-06-27 | - | 1 | - | historical errors: 1 |
| 321 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Helmholtz-Zentrum fuer Infektionsforschung GmbH, organizationalUnitName=Rechenzentrum, commonName=Helmholtz-Zentrum fuer Infektionsforschung, emailAddress=sysadmin@helmholtz-hzi.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 322 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, organizationalUnitName=WKDV, commonName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress=wkdv-pki@ufz.de | yes | expired | 2008-02-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 323 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, organizationalUnitName=WKDV, commonName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress=wkdv-pki@ufz.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 324 | countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Hochschule fuer Kuenste Bremen, commonName=HFK-BREMEN-CA, emailAddress=hotline@hfk-bremen.de | yes | expired | 2009-03-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 325 | countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Hochschule fuer Kuenste Bremen, commonName=HFK-BREMEN-CA, emailAddress=hotline@hfk-bremen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 326 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Hochschule fuer Musik und Theater Hamburg, organizationalUnitName=IT Service Center, commonName=HfMT Hamburg CA - G01, emailAddress=pki@itsc.hfmt-hamburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 327 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Hochschule fuer Musik und Theater Hamburg, organizationalUnitName=IT Service Center, commonName=HfMT Hamburg CA - G01, emailAddress=pki@itsc.hfmt-hamburg.de | yes | expired | 2010-05-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 328 | countryName=DE, organizationName=Hochschule fuer Technik Stuttgart, organizationalUnitName=Rechenzentrum, commonName=HfT-Stuttgart CA-G01, emailAddress=pki@hft-stuttgart.de | yes | expired | 2007-07-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 329 | countryName=DE, organizationName=Hochschule fuer Technik Stuttgart, organizationalUnitName=Rechenzentrum, commonName=HfT-Stuttgart CA-G01, emailAddress=pki@hft-stuttgart.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 330 | countryName=DE, organizationName=Hochschule Furtwangen, organizationalUnitName=Rechenzentrum, commonName=HFU CA - G01, emailAddress=pki-ca@hs-furtwangen.de | yes | expired | 2008-12-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 331 | countryName=DE, organizationName=Hochschule Furtwangen, organizationalUnitName=Rechenzentrum, commonName=HFU CA - G01, emailAddress=pki-ca@hs-furtwangen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 332 | countryName=DE, organizationName=Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, commonName=HfWU, emailAddress=ca@hfwu.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 333 | countryName=DE, organizationName=Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, commonName=HfWU, emailAddress=ca@hfwu.de | yes | expired | 2007-07-06 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 334 | countryName=DE, organizationName=Hochschule fuer Grafik und Buchkunst Leipzig, organizationalUnitName=Rechenzentrum, commonName=HGB Leipzig CA - G02, emailAddress=pki@hgb-leipzig.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 335 | countryName=DE, organizationName=Hochschule fuer Grafik und Buchkunst Leipzig, organizationalUnitName=Rechenzentrum, commonName=HGB Leipzig CA - G02, emailAddress=pki@hgb-leipzig.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 336 | countryName=DE, organizationName=Hochschul-Informations-System GmbH, commonName=HIS GmbH CA, emailAddress=ca@his.de | yes | expired | 2010-02-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 337 | countryName=DE, organizationName=Hochschul-Informations-System GmbH, commonName=HIS GmbH CA, emailAddress=ca@his.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 338 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Hans-Knoell-Institut (HKI), commonName=HKI Jena CA - G01, emailAddress=ca@hki-jena.de | yes | expired | 2013-06-18 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 339 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Hans-Knoell-Institut (HKI), commonName=HKI Jena CA - G01, emailAddress=ca@hki-jena.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 340 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=HM Stuttgart CA, emailAddress=ca@mh-stuttgart.de | yes | revoked, expired | 2007-07-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 341 | countryName=DE, organizationName=Hahn-Meitner-Institut Berlin GmbH, organizationalUnitName=Abteilung DV-Systeme und Netze, commonName=HMI CA - G02, emailAddress=hmica@hmi.de | yes | expired | 2007-03-27 to 2019-03-26 | - | - | - | historical errors: 1 |
| 342 | countryName=DE, organizationName=Hochschule fuer Musik und Theater Hannover, commonName=HMT Hannover CA, emailAddress=pki@hmt-hannover.de | yes | expired | 2009-01-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 343 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Hochschule fuer Musik und Theater Rostock, commonName=HMT Rostock CA - G01, emailAddress=ca@hmt-rostock.de | yes | expired | 2015-01-15 to 2019-07-09 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 344 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Musik und Theater Leipzig, commonName=HMT-LEIPZIG-CA, emailAddress=pki@hmt-leipzig.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 345 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Musik und Theater Leipzig, commonName=HMT-LEIPZIG-CA, emailAddress=pki@hmt-leipzig.de | yes | expired | 2007-04-18 to 2019-04-17 | - | 1 | - | historical errors: 1 |
| 346 | countryName=DE, organizationName=Hochschule fuer Musik, Theater und Medien Hannover, commonName=HMTM Hannover CA, emailAddress=pki@hmtm-hannover.de | yes | expired | 2010-07-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 347 | countryName=DE, organizationName=Hochschule fuer Musik, Theater und Medien Hannover, commonName=HMTM Hannover CA, emailAddress=pki@hmtm-hannover.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 348 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Hochschule Bonn-Rhein-Sieg, commonName=Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@hochschule-bonn-rhein-sieg.de | yes | expired | 2009-10-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 349 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Hochschule Bonn-Rhein-Sieg, commonName=Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@hochschule-bonn-rhein-sieg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 350 | countryName=DE, organizationName=Hochschule Bremen, commonName=Hochschule Bremen CA 1, emailAddress=pki@hs-bremen.de | yes | expired | 2009-03-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 351 | countryName=DE, organizationName=Hochschule Bremen, commonName=Hochschule Bremen CA 1, emailAddress=pki@hs-bremen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 352 | countryName=DE, organizationName=Hochschule Bremerhaven, organizationalUnitName=ZBRV, commonName=Hochschule Bremerhaven CA, emailAddress=pki@hs-bremerhaven.de | yes | expired | 2009-04-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 353 | countryName=DE, organizationName=Hochschule Bremerhaven, organizationalUnitName=ZBRV, commonName=Hochschule Bremerhaven CA, emailAddress=pki@hs-bremerhaven.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 354 | countryName=DE, localityName=Darmstadt, organizationName=Hochschule Darmstadt, commonName=Hochschule Darmstadt, emailAddress=pki@h-da.de | yes | expired | 2007-05-30 to 2019-05-28 | - | 1 | - | historical errors: 1 |
| 355 | countryName=DE, localityName=Darmstadt, organizationName=Hochschule Darmstadt, commonName=Hochschule Darmstadt, emailAddress=pki@h-da.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 356 | countryName=DE, stateOrProvinceName=Bayern, localityName=Deggendorf, organizationName=Hochschule fuer angewandte Wissenschaften - FH Deggendorf, organizationalUnitName=Rechenzentrum, commonName=Hochschule Deggendorf CA - G01, emailAddress=pki@fh-deggendorf.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 357 | countryName=DE, stateOrProvinceName=Bayern, localityName=Deggendorf, organizationName=Hochschule fuer angewandte Wissenschaften - FH Deggendorf, organizationalUnitName=Rechenzentrum, commonName=Hochschule Deggendorf CA - G01, emailAddress=pki@fh-deggendorf.de | yes | expired | 2008-03-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 358 | countryName=DE, stateOrProvinceName=Bayern, localityName=Hof, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, organizationalUnitName=Rechenzentrum, commonName=Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress=pki@fh-hof.de | yes | expired | 2007-09-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 359 | countryName=DE, stateOrProvinceName=Bayern, localityName=Hof, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, organizationalUnitName=Rechenzentrum, commonName=Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress=pki@fh-hof.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 360 | countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen 'Konrad Wolf', commonName=Hochschule fuer Film und Fernsehen 'Konrad Wolf' CA, emailAddress=pki@hff-potsdam.de | yes | expired | 2009-10-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 361 | countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen Konrad Wolf, commonName=Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress=pki@hff-potsdam.de | yes | expired | 2009-11-04 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 362 | countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen Konrad Wolf, commonName=Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress=pki@hff-potsdam.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 363 | countryName=DE, organizationName=Hochschule fuer Gestaltung Karlsruhe, commonName=Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress=pki@hfg.edu | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 364 | countryName=DE, organizationName=Hochschule fuer Gestaltung Karlsruhe, commonName=Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress=pki@hfg.edu | yes | expired | 2009-09-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 365 | countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Hochschule fuer Technik und Wirtschaft Berlin, emailAddress=ca@htw-berlin.de | yes | expired | 2009-02-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 366 | countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Hochschule fuer Technik und Wirtschaft Berlin, emailAddress=ca@htw-berlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 367 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hamm, organizationName=Hochschule Hamm-Lippstadt, commonName=Hochschule Hamm-Lippstadt CA - G01 | yes | expired | 2012-08-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | clean |
| 368 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hamm, organizationName=Hochschule Hamm-Lippstadt, commonName=Hochschule Hamm-Lippstadt CA - G01 | yes | expired | 2014-05-06 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 369 | countryName=DE, organizationName=Hochschule Heilbronn, organizationalUnitName=Rechenzentrum, commonName=Hochschule Heilbronn CA-G02, emailAddress=pki@hs-heilbronn.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 370 | countryName=DE, organizationName=Hochschule Heilbronn, organizationalUnitName=Rechenzentrum, commonName=Hochschule Heilbronn CA-G02, emailAddress=pki@hs-heilbronn.de | yes | expired | 2008-09-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 371 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Senftenberg, organizationName=Hochschule Lausitz, commonName=Hochschule Lausitz CA, emailAddress=pki@hs-lausitz.de | yes | expired | 2009-05-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 372 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Senftenberg, organizationName=Hochschule Lausitz, commonName=Hochschule Lausitz CA, emailAddress=pki@hs-lausitz.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 373 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Hochschule Muenchen, commonName=Hochschule Muenchen CA, emailAddress=dfn-ca@hm.edu | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 374 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Hochschule Muenchen, commonName=Hochschule Muenchen CA, emailAddress=dfn-ca@hm.edu | yes | expired | 2007-12-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 375 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Krefeld, organizationName=Hochschule Niederrhein, organizationalUnitName=Datenverarbeitungszentrale, commonName=Hochschule Niederrhein CA - G01, emailAddress=pki@hs-niederrhein.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 376 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Krefeld, organizationName=Hochschule Niederrhein, organizationalUnitName=Datenverarbeitungszentrale, commonName=Hochschule Niederrhein CA - G01, emailAddress=pki@hs-niederrhein.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 377 | countryName=DE, organizationName=Hochschule Offenburg, commonName=Hochschule Offenburg CA | yes | expired | 2008-10-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 378 | countryName=DE, organizationName=Hochschule Offenburg, commonName=Hochschule Offenburg CA | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 379 | countryName=DE, organizationName=Hochschule Osnabrueck, organizationalUnitName=zentrale IT, commonName=Hochschule Osnabrueck CA - G 01, emailAddress=ca@hs-osnabrueck.de | yes | expired | 2010-10-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 380 | countryName=DE, organizationName=Hochschule Osnabrueck, organizationalUnitName=zentrale IT, commonName=Hochschule Osnabrueck CA - G 01, emailAddress=ca@hs-osnabrueck.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 381 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muelheim an der Ruhr, organizationName=Hochschule Ruhr West, organizationalUnitName=IT Service, commonName=Hochschule Ruhr West CA, emailAddress=admin@hs-rw.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 382 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muelheim an der Ruhr, organizationName=Hochschule Ruhr West, organizationalUnitName=IT Service, commonName=Hochschule Ruhr West CA, emailAddress=admin@hs-rw.de | yes | expired | 2010-10-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 383 | countryName=DE, organizationName=Hochschule Anhalt (FH), organizationalUnitName=ZIK, commonName=HS Anhalt CA - G02, emailAddress=ca@hs-anhalt.de | yes | expired | 2007-02-13 to 2019-02-12 | - | - | - | historical errors: 1 |
| 384 | countryName=DE, organizationName=Hochschule Anhalt (FH), organizationalUnitName=ZIK, commonName=HS Anhalt CA - G02, emailAddress=ca@hs-anhalt.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 385 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Hochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=HS Ansbach CA, emailAddress=ca@hs-ansbach.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 386 | countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Hochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=HS Ansbach CA, emailAddress=ca@hs-ansbach.de | yes | expired | 2010-04-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 387 | countryName=DE, organizationName=Hochschule Bochum, commonName=HS Bochum CA - G01, emailAddress=ca@hs-bochum.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 388 | countryName=DE, organizationName=Hochschule Bochum, commonName=HS Bochum CA - G01, emailAddress=ca@hs-bochum.de | yes | expired | 2013-01-21 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 389 | countryName=DE, organizationName=Hochschule Fulda, organizationalUnitName=Datenverarbeitungszentrum, commonName=HS Fulda CA - G02, emailAddress=pki@hs-fulda.de | yes | expired | 2007-05-24 to 2019-05-23 | - | 1 | - | historical errors: 1 |
| 390 | countryName=DE, organizationName=Hochschule Fulda, organizationalUnitName=Datenverarbeitungszentrum, commonName=HS Fulda CA - G02, emailAddress=pki@hs-fulda.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 391 | countryName=DE, stateOrProvinceName=Hessen, localityName=Geisenheim, organizationName=Hochschule Geisenheim, commonName=HS Geisenheim CA - G01, emailAddress=ca@hs-gm.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 392 | countryName=DE, stateOrProvinceName=Hessen, localityName=Geisenheim, organizationName=Hochschule Geisenheim, commonName=HS Geisenheim CA - G01, emailAddress=ca@hs-gm.de | yes | expired | 2013-03-19 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 393 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Hochschule Hannover, commonName=HS Hannover CA - G01, emailAddress=pki@hs-hannover.de | yes | expired | 2014-09-23 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 394 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Kehl, organizationName=Hochschule fuer oeffentliche Verwaltung Kehl, commonName=HS Kehl CA - G01 | yes | expired | 2014-08-25 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 395 | countryName=DE, organizationName=Hochschule Kempten, commonName=HS Kempten CA, emailAddress=pki@fh-kempten.de | yes | expired | 2008-11-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 396 | countryName=DE, organizationName=Hochschule Kempten, commonName=HS Kempten CA, emailAddress=pki@fh-kempten.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 397 | countryName=DE, organizationName=Hochschule fuer oeffentliche Verwaltung und Finanzen Ludwigsburg, organizationalUnitName=Zentrum fuer Medien und Informationstechnologie, commonName=HS Ludwigsburg CA - G01, emailAddress=ca@hs-ludwigsburg.de | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 398 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Magdeburg, organizationName=Hochschule Magdeburg Stendal (FH), commonName=HS Magdeburg Stendal (FH) CA - G01, emailAddress=pki@hs-magdeburg.de | yes | expired | 2007-04-11 to 2019-04-09 | - | - | - | historical errors: 1 |
| 399 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Magdeburg, organizationName=Hochschule Magdeburg Stendal (FH), commonName=HS Magdeburg Stendal (FH) CA - G01, emailAddress=pki@hs-magdeburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 400 | countryName=DE, organizationName=Hochschule Mannheim, commonName=HS Mannheim CA, emailAddress=pki@hs-mannheim.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 401 | countryName=DE, organizationName=Hochschule Mannheim, commonName=HS Mannheim CA, emailAddress=pki@hs-mannheim.de | yes | expired | 2008-02-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 402 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Merseburg, organizationName=Hochschule Merseburg (FH), organizationalUnitName=Rechenzentrum, commonName=HS Merseburg CA, emailAddress=pki@hs-merseburg.de | yes | expired | 2009-09-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 403 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Merseburg, organizationName=Hochschule Merseburg (FH), organizationalUnitName=Rechenzentrum, commonName=HS Merseburg CA, emailAddress=pki@hs-merseburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 404 | countryName=DE, organizationName=Hochschule Neubrandenburg, organizationalUnitName=Hochschulrechenzentrum, commonName=HS NB - CA - G02, emailAddress=pki@hs-nb.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 405 | countryName=DE, organizationName=Hochschule Neubrandenburg, organizationalUnitName=Hochschulrechenzentrum, commonName=HS NB - CA - G02, emailAddress=pki@hs-nb.de | yes | expired | 2007-03-14 to 2019-03-13 | - | - | - | historical errors: 1 |
| 406 | countryName=DE, organizationName=Hochschule Ostwestfalen-Lippe, commonName=HS OWL CA - G01, emailAddress=ca@hs-owl.de | yes | expired | 2008-04-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 407 | countryName=DE, organizationName=Hochschule Ostwestfalen-Lippe, commonName=HS OWL CA - G01, emailAddress=ca@hs-owl.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 408 | countryName=DE, organizationName=Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, commonName=HS Reutlingen CA - G01, emailAddress=ca@reutlingen-university.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 409 | countryName=DE, organizationName=Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, commonName=HS Reutlingen CA - G01, emailAddress=ca@reutlingen-university.de | yes | expired | 2013-12-18 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 410 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Aalen, organizationName=Hochschule Aalen, commonName=HS-Aalen-CA-G01, emailAddress=pki@htw-aalen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 411 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Aalen, organizationName=Hochschule Aalen, commonName=HS-Aalen-CA-G01, emailAddress=pki@htw-aalen.de | yes | expired | 2009-01-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 412 | countryName=DE, stateOrProvinceName=Niedersachsen, organizationName=Hochschule Emden/Leer, commonName=HS-EL CA, emailAddress=pki@hs-emden-leer.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 413 | countryName=DE, stateOrProvinceName=Niedersachsen, organizationName=Hochschule Emden/Leer, commonName=HS-EL CA, emailAddress=pki@hs-emden-leer.de | yes | expired | 2011-10-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 414 | countryName=DE, organizationName=HS-Harz, commonName=HS-Harz-CA, emailAddress=CA@hs-harz.de | yes | expired | 2007-03-21 to 2019-03-20 | - | - | - | historical errors: 1 |
| 415 | countryName=DE, organizationName=HS-Harz, commonName=HS-Harz-CA, emailAddress=CA@hs-harz.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 416 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ulm, organizationName=Hochschule Ulm, commonName=HS-Ulm-CA, emailAddress=pki@hs-ulm.de | yes | expired | 2008-01-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 417 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ulm, organizationName=Hochschule Ulm, commonName=HS-Ulm-CA, emailAddress=pki@hs-ulm.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 418 | countryName=DE, organizationName=Hochschule Ravensburg-Weingarten, commonName=HS-WGT-CA-G02, emailAddress=hs-wgt-ca@hs-weingarten.de | yes | expired | 2007-02-26 to 2019-02-25 | - | - | - | historical errors: 1 |
| 419 | countryName=DE, organizationName=Hochschule Ravensburg-Weingarten, commonName=HS-WGT-CA-G02, emailAddress=hs-wgt-ca@hs-weingarten.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 420 | countryName=DE, organizationName=Hochschule Wilhelmshaven/Oldenburg/Elsfleth, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de | yes | expired | 2010-05-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 421 | countryName=DE, organizationName=Hochschule Wilhelmshaven/Oldenburg/Elsfleth, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 422 | countryName=DE, organizationName=Hochschule Wilhelmshaven, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de | yes | revoked, expired | 2010-05-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 423 | countryName=DE, organizationName=Hochschule Zittau/Goerlitz, commonName=HS-ZIGR CA, emailAddress=ca@hs-zigr.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 424 | countryName=DE, organizationName=Hochschule Zittau/Goerlitz, commonName=HS-ZIGR CA, emailAddress=ca@hs-zigr.de | yes | expired | 2007-04-11 to 2019-04-09 | - | - | - | historical errors: 1 |
| 425 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Hochschule Karlsruhe - Technik und Wirtschaft, commonName=HSKA-CA, emailAddress=iz-ca@hs-karlsruhe.de | yes | expired | 2007-11-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 426 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Hochschule Karlsruhe - Technik und Wirtschaft, commonName=HSKA-CA, emailAddress=iz-ca@hs-karlsruhe.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 427 | countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Hochschule RheinMain, organizationalUnitName=IT-Center, commonName=HSRM-CA, emailAddress=pki-itc@hs-rm.de | yes | expired | 2011-06-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 428 | countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Hochschule RheinMain, organizationalUnitName=IT-Center, commonName=HSRM-CA, emailAddress=pki-itc@hs-rm.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 429 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Kleve, organizationName=Hochschule Rhein-Waal, commonName=HSRW CA, emailAddress=pki@hsrw.eu | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 430 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Kleve, organizationName=Hochschule Rhein-Waal, commonName=HSRW CA, emailAddress=pki@hsrw.eu | yes | expired | 2010-04-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 431 | countryName=DE, organizationName=Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, commonName=HSU CA - G01, emailAddress=ca@hsu-hh.de | yes | expired | 2007-11-14 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 432 | countryName=DE, organizationName=Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, commonName=HSU CA - G01, emailAddress=ca@hsu-hh.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 433 | countryName=DE, organizationName=Hochschule Wismar, commonName=hswca - G02, emailAddress=pki@hs-wismar.de | yes | expired | 2007-03-27 to 2019-03-26 | - | - | - | historical errors: 1 |
| 434 | countryName=DE, organizationName=Hochschule Wismar, commonName=hswca - G02, emailAddress=pki@hs-wismar.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 435 | countryName=DE, organizationName=Hochschulservicezentrum Baden-Wuerttemberg, organizationalUnitName=SNA, commonName=HSZ-BW CA, emailAddress=ca@hsz-bw.de | yes | expired | 2010-03-29 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 436 | countryName=DE, organizationName=Hochschulservicezentrum Baden-Wuerttemberg, organizationalUnitName=SNA, commonName=HSZ-BW CA, emailAddress=ca@hsz-bw.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 437 | countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Dresden (FH), commonName=HTW-Dresden CA - G02, emailAddress=ca@rz.htw-dresden.de | yes | expired | 2007-02-13 to 2019-02-12 | - | - | - | historical errors: 1 |
| 438 | countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Dresden (FH), commonName=HTW-Dresden CA - G02, emailAddress=ca@rz.htw-dresden.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 439 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Konstanz, organizationName=Hochschule Konstanz Technik, Wirtschaft und Gestaltung, commonName=HTWG KN CA, emailAddress=pki@htwg-konstanz.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 440 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Konstanz, organizationName=Hochschule Konstanz Technik, Wirtschaft und Gestaltung, commonName=HTWG KN CA, emailAddress=pki@htwg-konstanz.de | yes | expired | 2010-11-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 441 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kultur Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 442 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kunst Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de | yes | revoked, expired | 2008-06-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 443 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kultur Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de | yes | expired | 2008-07-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 444 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Mittweida, organizationName=Hochschule Mittweida (FH) - University of Applied Sciences, commonName=HTWM CA, emailAddress=pki@htwm.de | yes | expired | 2007-11-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 445 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Mittweida, organizationName=Hochschule Mittweida (FH) - University of Applied Sciences, commonName=HTWM CA, emailAddress=pki@htwm.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 446 | countryName=DE, organizationName=Humboldt-Universitaet zu Berlin, commonName=HU-CA, emailAddress=pki@hu-berlin.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 447 | countryName=DE, organizationName=Humboldt-Universitaet zu Berlin, commonName=HU-CA, emailAddress=pki@hu-berlin.de | yes | expired | 2007-11-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 448 | countryName=DE, organizationName=Hochschule fuer Wirtschaft und Recht Berlin, commonName=HWR Berlin CA, emailAddress=pki@hwr-berlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 449 | countryName=DE, organizationName=Hochschule fuer Wirtschaft und Recht Berlin, commonName=HWR Berlin CA, emailAddress=pki@hwr-berlin.de | yes | expired | 2009-03-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 450 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, commonName=HZB CA, emailAddress=hzbca@helmholtz-berlin.de | yes | expired | 2009-06-29 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 451 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, commonName=HZB CA, emailAddress=hzbca@helmholtz-berlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 452 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Geesthacht, organizationName=Helmholtz-Zentrum Geesthacht GmbH, commonName=HZG CA, emailAddress=ca@hzg.de | yes | expired | 2010-09-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 453 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Geesthacht, organizationName=Helmholtz-Zentrum Geesthacht GmbH, commonName=HZG CA, emailAddress=ca@hzg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 454 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Kuehlungsborn, organizationName=Leibniz-Institut fuer Atmosphaerenphysik, organizationalUnitName=Rechenzentrum, commonName=IAP CA - G01, emailAddress=ca@iap-kborn.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 455 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Kuehlungsborn, organizationName=Leibniz-Institut fuer Atmosphaerenphysik, organizationalUnitName=Rechenzentrum, commonName=IAP CA - G01, emailAddress=ca@iap-kborn.de | yes | expired | 2007-03-20 to 2019-03-19 | - | - | - | historical errors: 1 |
| 456 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Institute for Advanced Sustainability Studies e.V., organizationalUnitName=IT-Management, commonName=IASS Potsdam CA, emailAddress=ca@iass-potsdam.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 457 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Institute for Advanced Sustainability Studies e.V., organizationalUnitName=IT-Management, commonName=IASS Potsdam CA, emailAddress=ca@iass-potsdam.de | yes | expired | 2012-03-01 to 2019-06-30 | - | 1 | - | clean |
| 458 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Institut fuer Deutsche Sprache, commonName=IDS-CA - G01, emailAddress=ca@ids-mannheim.de | yes | expired | 2013-05-29 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 459 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Institut fuer Deutsche Sprache, commonName=IDS-CA - G01, emailAddress=ca@ids-mannheim.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 460 | countryName=DE, organizationName=IFM-GEOMAR, organizationalUnitName=Rechenzentrum, commonName=IFM-GEOMAR CA - G02, emailAddress=pki@ifm-geomar.de | yes | expired | 2007-02-26 to 2019-02-25 | - | - | - | historical errors: 1 |
| 461 | countryName=DE, organizationName=Leibniz-Institut fuer Neurobiologie Magdeburg, commonName=ifn-magdeburg CA-G01, emailAddress=pki@ifn-magdeburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 462 | countryName=DE, organizationName=Leibniz-Institut fuer Neurobiologie Magdeburg, commonName=ifn-magdeburg CA-G01, emailAddress=pki@ifn-magdeburg.de | yes | expired | 2009-06-29 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 463 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=IFW Dresden e.V., commonName=IFW Dresden CA, emailAddress=ca@ifw-dresden.de | yes | expired | 2008-04-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 464 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=IFW Dresden e.V., commonName=IFW Dresden CA, emailAddress=ca@ifw-dresden.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 465 | countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki.ca@ihp-microelectronics.com | yes | expired | 2007-10-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 466 | countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki@ihp-microelectronics.com | yes | revoked, expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 467 | countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki.ca@ihp-microelectronics.com | yes | expired | 2014-08-28 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 468 | countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki@ihp-microelectronics.com | yes | revoked, expired | 2007-10-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 469 | countryName=DE, organizationName=Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, commonName=ILK Dresden CA - G01, emailAddress=ca@ilkdresden.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 470 | countryName=DE, organizationName=Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, commonName=ILK Dresden CA - G01, emailAddress=ca@ilkdresden.de | yes | expired | 2012-09-19 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 471 | countryName=DE, localityName=Greifswald, organizationName=Leibniz-Institut fuer Plasmaforschung und Technologie e.V., commonName=INP-Greifswald CA, emailAddress=ca@inp-greifswald.de | yes | expired | 2007-12-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 472 | countryName=DE, localityName=Greifswald, organizationName=Leibniz-Institut fuer Plasmaforschung und Technologie e.V., commonName=INP-Greifswald CA, emailAddress=ca@inp-greifswald.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 473 | countryName=DE, organizationName=Institut fuer Weltwirtschaft an der Universitaet Kiel, organizationalUnitName=IT-Strukturen, commonName=Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress=pki@ifw-kiel.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 474 | countryName=DE, organizationName=Institut fuer Weltwirtschaft an der Universitaet Kiel, organizationalUnitName=IT-Strukturen, commonName=Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress=pki@ifw-kiel.de | yes | expired | 2011-12-05 to 2019-06-30 | - | 1 | - | clean |
| 475 | countryName=DE, organizationName=Institut fuer Seeverkehrswirtschaft und Logistik (ISL), commonName=Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress=pki@isl.org | yes | expired | 2011-05-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 476 | countryName=DE, organizationName=Institut fuer Seeverkehrswirtschaft und Logistik (ISL), commonName=Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress=pki@isl.org | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 477 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de | yes | expired | 2007-04-11 to 2019-04-09 | - | 1 | - | historical errors: 1 |
| 478 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de | yes | expired | 2007-04-11 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 479 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de | yes | expired | 2007-04-11 to 2019-04-09 | - | - | - | historical errors: 1 |
| 480 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Institut fuer Photonische Technologien e.V., organizationalUnitName=EDV/IPHT, commonName=IPHT-JENA-CA, emailAddress=ipht-cert@ipht-jena.de | yes | expired | 2007-05-16 to 2019-05-15 | - | 1 | - | historical errors: 1 |
| 481 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Institut fuer Photonische Technologien e.V., organizationalUnitName=EDV/IPHT, commonName=IPHT-JENA-CA, emailAddress=ipht-cert@ipht-jena.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 482 | countryName=DE, organizationName=IPK Gatersleben, commonName=IPK Gatersleben CA - G02, emailAddress=ca@ipk-gatersleben.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 483 | countryName=DE, organizationName=IPK Gatersleben, commonName=IPK Gatersleben CA - G02, emailAddress=ca@ipk-gatersleben.de | yes | expired | 2008-09-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 484 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., organizationalUnitName=IT, commonName=ISAS CA - G01, emailAddress=pki@isas.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 485 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., organizationalUnitName=IT, commonName=ISAS CA - G01, emailAddress=pki@isas.de | yes | expired | 2009-12-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 486 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Tuebingen, organizationName=Stiftung Medien in der Bildung Leibniz-Institut f. Wissensmedien, organizationalUnitName=Medientechnik, commonName=IWM CA - G01, emailAddress=ca@iwm-tuebingen.de | yes | expired | 2015-03-24 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 487 | countryName=DE, organizationName=Jacobs University Bremen gGmbH, organizationalUnitName=IRC-IT, commonName=Jacobs University CA - G01 | yes | expired | 2007-03-13 to 2019-03-12 | - | - | - | historical errors: 1 |
| 488 | countryName=DE, organizationName=Jacobs University Bremen gGmbH, organizationalUnitName=IRC-IT, commonName=Jacobs University CA - G01 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 489 | countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Johannes Gutenberg-Universitaet Mainz, commonName=JGU CA - G01, emailAddress=jgu-ca@uni-mainz.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 490 | countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Johannes Gutenberg-Universitaet Mainz, commonName=JGU CA - G01, emailAddress=jgu-ca@uni-mainz.de | yes | expired | 2012-03-27 to 2019-06-30 | - | 1 | - | clean |
| 491 | countryName=DE, organizationName=Julius Kuehn-Institut, commonName=Julius Kuehn-Institut CA - G01, emailAddress=ca@jki.bund.de | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 492 | countryName=DE, organizationName=Kath. Universitaet Eichstaett-Ingolstadt, organizationalUnitName=Universitaetsrechenzentrum, commonName=Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress=pki@ku-eichstaett.de | yes | expired | 2007-01-30 to 2019-01-29 | - | - | - | historical errors: 1 |
| 493 | countryName=DE, organizationName=Kath. Universitaet Eichstaett-Ingolstadt, organizationalUnitName=Universitaetsrechenzentrum, commonName=Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress=pki@ku-eichstaett.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 494 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Katholische Fachhochschule gGmbH, organizationalUnitName=IuK, commonName=KatHO NRW CA - G01, emailAddress=ca@katho-nrw.de | yes | expired | 2015-03-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 495 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Kunsthochschule Berlin (Weissensee) - Hochschule fuer Gestaltung, organizationalUnitName=ServiceCenter-IT, commonName=KH Berlin Weissensee CA - G01, emailAddress=sc-it@kh-berlin.de | yes | expired | 2015-03-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 496 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, commonName=KIT-CA | yes | current | 2016-11-03 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 497 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, organizationalUnitName=Steinbuch Centre for Computing, commonName=KIT-CA, emailAddress=ca@kit.edu | yes | expired | 2008-08-22 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 498 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, organizationalUnitName=Steinbuch Centre for Computing, commonName=KIT-CA, emailAddress=ca@kit.edu | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 499 | countryName=DE, organizationName=Kuehne Logistics University GmbH, commonName=Kuehne Logistics University GmbH CA, emailAddress=pki@the-klu.org | yes | expired | 2010-11-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 500 | countryName=DE, organizationName=Kuehne Logistics University GmbH, commonName=Kuehne Logistics University GmbH CA, emailAddress=pki@the-klu.org | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 501 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Staatliche Akademie der Bildenden Kuenste Karlsruhe, commonName=Kunstakademie Karlsruhe CA - G01, emailAddress=ca@kunstakademie-karlsruhe.de | yes | expired | 2014-08-25 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 502 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Erfurt, organizationName=Landeshauptstadt Erfurt Stadtverwaltung, commonName=Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress=pki@erfurt.de | yes | expired | 2011-03-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 503 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Erfurt, organizationName=Landeshauptstadt Erfurt Stadtverwaltung, commonName=Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress=pki@erfurt.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 504 | countryName=DE, organizationName=Leibniz-Institut fuer Altersforschung - FLI e. V., organizationalUnitName=SG IT, commonName=Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress=sgit@fli-leibniz.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 505 | countryName=DE, organizationName=Leibniz-Institut fuer Altersforschung - FLI e. V., organizationalUnitName=SG IT, commonName=Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress=sgit@fli-leibniz.de | yes | expired | 2013-02-08 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 506 | countryName=DE, organizationName=Leibniz-Institut fuer Arbeitsforschung Dortmund, commonName=Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress=pki@ifado.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 507 | countryName=DE, organizationName=Leibniz-Institut fuer Arbeitsforschung Dortmund, commonName=Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress=pki@ifado.de | yes | expired | 2011-11-30 to 2019-06-30 | - | 1 | - | clean |
| 508 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Leibniz-Institut fuer Astrophysik Potsdam (AIP), commonName=Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01 | yes | expired | 2012-08-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | clean |
| 509 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Leibniz-Institut fuer Astrophysik Potsdam (AIP), commonName=Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01 | yes | expired | 2014-05-06 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 510 | countryName=DE, organizationName=Leibniz-Institut fuer Nutztierbiologie, commonName=Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress=edv-zentral@fbn-dummerstorf.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 511 | countryName=DE, organizationName=Leibniz-Institut fuer Nutztierbiologie, commonName=Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress=edv-zentral@fbn-dummerstorf.de | yes | expired | 2012-12-13 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 512 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Lueneburg, organizationName=Leuphana Universitaet Lueneburg, organizationalUnitName=Rechen- und Medienzentrum, commonName=Leuphana Universitaet Lueneburg CA, emailAddress=ca@leuphana.de | yes | expired | 2008-02-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 513 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Lueneburg, organizationName=Leuphana Universitaet Lueneburg, organizationalUnitName=Rechen- und Medienzentrum, commonName=Leuphana Universitaet Lueneburg CA, emailAddress=ca@leuphana.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 514 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Leibniz-Institut fuer Katalyse e.V., commonName=LIKAT CA, emailAddress=ca@catalysis.de | yes | expired | 2007-05-22 to 2019-05-21 | - | 1 | - | historical errors: 1 |
| 515 | countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Leibniz-Institut fuer Katalyse e.V., commonName=LIKAT CA, emailAddress=ca@catalysis.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 516 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Ludwig-Maximilians-Universitaet Muenchen, commonName=LMU-CA, emailAddress=pki@lmu.de | yes | expired | 2007-09-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 517 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Ludwig-Maximilians-Universitaet Muenchen, commonName=LMU-CA, emailAddress=pki@lmu.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 518 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de | yes | expired | 2007-01-23 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 519 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de | yes | expired | 2007-01-23 to 2019-01-15 | - | 1 | - | historical errors: 1 |
| 520 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de | yes | revoked, expired | 2007-01-23 to 2019-01-15 | - | - | - | historical errors: 1 |
| 521 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Land Niedersachsen, organizationalUnitName=Landesbetrieb fuer Statistik und Kommunikationstechnologie, commonName=LSKN CA, emailAddress=ca@lskn.niedersachsen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 522 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Land Niedersachsen, organizationalUnitName=Landesbetrieb fuer Statistik und Kommunikationstechnologie, commonName=LSKN CA, emailAddress=ca@lskn.niedersachsen.de | yes | expired | 2009-07-29 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 523 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Oberwolfach, organizationName=Mathematisches Forschungsinstitut Oberwolfach gGmbH, commonName=Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress=ca@mfo.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 524 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Oberwolfach, organizationName=Mathematisches Forschungsinstitut Oberwolfach gGmbH, commonName=Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress=ca@mfo.de | yes | expired | 2008-12-17 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 525 | countryName=DE, organizationName=Max Rubner-Institut, commonName=Max Rubner-Institut CA - G01, emailAddress=ca@mri.bund.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 526 | countryName=DE, organizationName=Max Rubner-Institut, commonName=Max Rubner-Institut CA - G01, emailAddress=ca@mri.bund.de | yes | expired | 2013-12-18 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 527 | countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt, organizationName=Max-Planck-Institut fuer Biophysik, organizationalUnitName=Zentrale IT, commonName=Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress=CA@mpibp-frankfurt.mpg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 528 | countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt, organizationName=Max-Planck-Institut fuer Biophysik, organizationalUnitName=Zentrale IT, commonName=Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress=CA@mpibp-frankfurt.mpg.de | yes | expired | 2009-04-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 529 | countryName=DE, organizationName=Mitteldeutscher Rundfunk, commonName=MDR CA | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 530 | countryName=DE, organizationName=Mitteldeutscher Rundfunk, commonName=MDR CA | yes | expired | 2007-06-28 to 2019-06-27 | - | 1 | - | historical errors: 1 |
| 531 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg i. Br., organizationName=Hochschule fuer Musik Freiburg i. Br., commonName=MH Freiburg CA - G01, emailAddress=ca@mh-freiburg.de | yes | expired | 2015-02-19 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 532 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=MH Stuttgart CA, emailAddress=ca@mh-stuttgart.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 533 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=MH Stuttgart CA, emailAddress=ca@mh-stuttgart.de | yes | expired | 2007-07-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 534 | countryName=DE, organizationName=Medizinische Hochschule Hannover, commonName=MHH CA, emailAddress=pki@mh-hannover.de | yes | expired | 2008-10-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 535 | countryName=DE, organizationName=Medizinische Hochschule Hannover, commonName=MHH CA, emailAddress=pki@mh-hannover.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 536 | countryName=DE, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA, emailAddress=mpg-ca@mpg.de | yes | expired | 2007-07-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 537 | countryName=DE, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA, emailAddress=mpg-ca@mpg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 538 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA - G02 | yes | current | 2016-11-03 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 539 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, commonName=MPI Gemeinschaftsgueter CA, emailAddress=ca@coll.mpg.de | yes | expired | 2007-05-10 to 2019-05-08 | - | 1 | - | historical errors: 1 |
| 540 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, commonName=MPI Gemeinschaftsgueter CA, emailAddress=ca@coll.mpg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 541 | countryName=DE, organizationName=Max-Planck-Institut fuer Eisenforschung GmbH, organizationalUnitName=Network Centre, commonName=MPIE-CA - G01, emailAddress=ca@mpie.de | yes | expired | 2013-10-01 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 542 | countryName=DE, organizationName=Max-Planck-Institut fuer Eisenforschung GmbH, organizationalUnitName=Network Centre, commonName=MPIE-CA - G01, emailAddress=ca@mpie.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 543 | countryName=DE, organizationName=Max-Planck-Institut fuer Gesellschaftsforschung, organizationalUnitName=MPIfG, commonName=MPIfG-CA, emailAddress=ca@mpifg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 544 | countryName=DE, organizationName=Max-Planck-Institut fuer Gesellschaftsforschung, organizationalUnitName=MPIfG, commonName=MPIfG-CA, emailAddress=ca@mpifg.de | yes | expired | 2007-01-23 to 2019-01-15 | - | - | - | historical errors: 1 |
| 545 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Max-Planck-Institut fuer Zuechtungsforschung, organizationalUnitName=SUSAN, commonName=MPIZ CA, emailAddress=ca@mpiz-koeln.mpg.de | yes | expired | 2008-11-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 546 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Max-Planck-Institut fuer Zuechtungsforschung, organizationalUnitName=SUSAN, commonName=MPIZ CA, emailAddress=ca@mpiz-koeln.mpg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 547 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Staatliche Hochschule fuer Musik und Darstellende Kunst Mannheim, commonName=MUHO Mannheim CA - G01, emailAddress=ca@muho-mannheim.de | yes | expired | 2014-08-25 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 548 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Musikhochschule Luebeck, organizationalUnitName=Sachgebiet EDV, commonName=Musikhochschule Luebeck CA - G01, emailAddress=ca@mh-luebeck.de | yes | expired | 2012-02-02 to 2019-06-30 | - | 1 | - | clean |
| 549 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Musikhochschule Luebeck, organizationalUnitName=Sachgebiet EDV, commonName=Musikhochschule Luebeck CA - G01, emailAddress=ca@mh-luebeck.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 550 | countryName=DE, organizationName=Staatliche Hochschule fuer Musik Trossingen, commonName=Musikhochschule Trossingen CA-G01, emailAddress=pki@mh-trossingen.de | yes | expired | 2009-12-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 551 | countryName=DE, organizationName=Staatliche Hochschule fuer Musik Trossingen, commonName=Musikhochschule Trossingen CA-G01, emailAddress=pki@mh-trossingen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 552 | countryName=DE, organizationName=NEC Europe Ltd., organizationalUnitName=NEC Laboratories Europe, commonName=NECLAB-CA, emailAddress=zertifizierungsstelle@nw.neclab.eu | yes | expired | 2008-10-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 553 | countryName=DE, organizationName=NEC Europe Ltd., organizationalUnitName=NEC Laboratories Europe, commonName=NECLAB-CA, emailAddress=zertifizierungsstelle@nw.neclab.eu | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 554 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Elmshorn, organizationName=NORDAKADEMIE gAG, commonName=NORDAKADEMIE CA-01, emailAddress=pki@nordakademie.de | yes | expired | 2008-02-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 555 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Elmshorn, organizationName=NORDAKADEMIE gAG, commonName=NORDAKADEMIE CA-01, emailAddress=pki@nordakademie.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 556 | countryName=DE, organizationName=OFFIS e. V., commonName=OFFIS CA - G01, emailAddress=offis-ca@offis.de | yes | expired | 2014-12-09 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 557 | countryName=DE, organizationName=Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, organizationalUnitName=Rechenzentrum, commonName=Ohm CA - G01, emailAddress=HS-PKI@ohm-hochschule.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 558 | countryName=DE, organizationName=Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, organizationalUnitName=Rechenzentrum, commonName=Ohm CA - G01, emailAddress=HS-PKI@ohm-hochschule.de | yes | expired | 2008-02-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 559 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Weingarten, organizationName=Paedagogische Hochschule Weingarten, commonName=Paedagogische Hochschule Weingarten CA, emailAddress=phwgtca@ph-weingarten.de | yes | expired | 2009-05-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 560 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Weingarten, organizationName=Paedagogische Hochschule Weingarten, commonName=Paedagogische Hochschule Weingarten CA, emailAddress=phwgtca@ph-weingarten.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 561 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Paedagogische Hochschule Heidelberg, organizationalUnitName=IfDI, commonName=PH Heidelberg CA, emailAddress=pki@ph-heidelberg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 562 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Paedagogische Hochschule Heidelberg, organizationalUnitName=IfDI, commonName=PH Heidelberg CA, emailAddress=pki@ph-heidelberg.de | yes | expired | 2009-12-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 563 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Paedagogische Hochschule Ludwigsburg, organizationalUnitName=Hochschulrechenzentrum, commonName=PH Ludwigsburg CA - G01, emailAddress=rz-ca@ph-ludwigsburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 564 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Paedagogische Hochschule Ludwigsburg, organizationalUnitName=Hochschulrechenzentrum, commonName=PH Ludwigsburg CA - G01, emailAddress=rz-ca@ph-ludwigsburg.de | yes | expired | 2009-11-30 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 565 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Schwaebisch Gmuend, organizationName=Paedagogische Hochschule Schwaebisch Gmuend, organizationalUnitName=MIZ, commonName=PH Schwaebisch Gmuend CA, emailAddress=ra@ph-gmuend.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 566 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Schwaebisch Gmuend, organizationName=Paedagogische Hochschule Schwaebisch Gmuend, organizationalUnitName=MIZ, commonName=PH Schwaebisch Gmuend CA, emailAddress=ra@ph-gmuend.de | yes | expired | 2009-05-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 567 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg, organizationName=Paedagogische Hochschule Freiburg, organizationalUnitName=ZIK, commonName=PH-FR CA, emailAddress=pki@ph-freiburg.de | yes | expired | 2009-07-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 568 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg, organizationName=Paedagogische Hochschule Freiburg, organizationalUnitName=ZIK, commonName=PH-FR CA, emailAddress=pki@ph-freiburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 569 | countryName=DE, organizationName=Paedagogische Hochschule Karlsruhe, organizationalUnitName=ZIM, commonName=PHKA CA, emailAddress=pki@ph-karlsruhe.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 570 | countryName=DE, organizationName=Paedagogische Hochschule Karlsruhe, organizationalUnitName=ZIM, commonName=PHKA CA, emailAddress=pki@ph-karlsruhe.de | yes | expired | 2009-12-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 571 | countryName=DE, organizationName=Potsdam-Institut fuer Klimafolgenforschung e. V., commonName=PIK-CA - G01, emailAddress=ca@pik-potsdam.de | yes | expired | 2013-07-12 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 572 | countryName=DE, organizationName=Potsdam-Institut fuer Klimafolgenforschung e. V., commonName=PIK-CA - G01, emailAddress=ca@pik-potsdam.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 573 | countryName=DE, organizationName=Physikalisch-Technische Bundesanstalt, commonName=PTB CA, emailAddress=pki@ptb.de | yes | expired | 2008-10-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 574 | countryName=DE, organizationName=Physikalisch-Technische Bundesanstalt, commonName=PTB CA, emailAddress=pki@ptb.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 575 | countryName=DE, organizationName=Rundfunk Berlin-Brandenburg, commonName=rbb CA, emailAddress=ca-admin@rbb-online.de | yes | expired | 2007-05-14 to 2019-05-13 | - | 1 | - | historical errors: 1 |
| 576 | countryName=DE, organizationName=Rundfunk Berlin-Brandenburg, commonName=rbb CA, emailAddress=ca-admin@rbb-online.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 577 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Rheinische Fachhochschule Koeln gGmbH, organizationalUnitName=Rechenzentrum, commonName=RFH Koeln CA, emailAddress=pki@rfh-koeln.de | yes | expired | 2007-11-14 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 578 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Rheinische Fachhochschule Koeln gGmbH, organizationalUnitName=Rechenzentrum, commonName=RFH Koeln CA, emailAddress=pki@rfh-koeln.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 579 | countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA - G02, emailAddress=ca@rhrk.uni-kl.de | yes | expired | 2007-03-14 to 2019-03-13 | - | - | - | historical errors: 1 |
| 580 | countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA - G02, emailAddress=ca@rhrk.uni-kl.de | yes | expired | 2014-05-19 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 581 | countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA Classic - G02, emailAddress=ca@rhrk.uni-kl.de | yes | revoked, expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 582 | countryName=DE, organizationName=Robert Koch-Institut, organizationalUnitName=RKI-PCA, commonName=RKI Certification Authority, emailAddress=certify@rki.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 583 | countryName=DE, organizationName=Robert Koch-Institut, organizationalUnitName=RKI-PCA, commonName=RKI Certification Authority, emailAddress=certify@rki.de | yes | expired | 2007-03-20 to 2019-03-19 | - | - | - | historical errors: 1 |
| 584 | countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA, emailAddress=rub-chipcardca@uv.ruhr-uni-bochum.de | yes | expired | 2015-11-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 585 | countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA, emailAddress=rub-chipcardca@uv.ruhr-uni-bochum.de | yes | expired | 2009-02-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 586 | countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA G2 | yes | current | 2016-07-07 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 587 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Ruhr-Universitaet Bochum, commonName=Ruhr-Universitaet Bochum CA, emailAddress=rubca@ruhr-uni-bochum.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 588 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Ruhr-Universitaet Bochum, commonName=Ruhr-Universitaet Bochum CA, emailAddress=rubca@ruhr-uni-bochum.de | yes | expired | 2007-05-30 to 2019-05-29 | - | 1 | - | historical errors: 1 |
| 589 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de | yes | revoked, expired | 2007-06-28 to 2019-06-27 | - | 1 | - | historical errors: 1 |
| 590 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA-G Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de | yes | expired | 2007-07-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 591 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA-G Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 592 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Essen, organizationName=Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., organizationalUnitName=RWI-TD-EDV, commonName=RWI - TD-EDV CA, emailAddress=ca@rwi-essen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 593 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Essen, organizationName=Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., organizationalUnitName=RWI-TD-EDV, commonName=RWI - TD-EDV CA, emailAddress=ca@rwi-essen.de | yes | expired | 2011-02-04 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 594 | countryName=DE, organizationName=RWTH Aachen, commonName=RWTH Aachen CA, emailAddress=ca@rwth-aachen.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 595 | countryName=DE, organizationName=RWTH Aachen, commonName=RWTH Aachen CA, emailAddress=ca@rwth-aachen.de | yes | expired | 2007-02-14 to 2019-02-13 | - | - | - | historical errors: 1 |
| 596 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Freistaat Sachsen, organizationalUnitName=Saechsisches Staatsministerium des Innern, commonName=Sachsen Global CA, emailAddress=pki@smi.sachsen.de | yes | expired | 2009-07-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 597 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Freistaat Sachsen, organizationalUnitName=Saechsisches Staatsministerium des Innern, commonName=Sachsen Global CA, emailAddress=pki@smi.sachsen.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 598 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Sanitaetsakademie der Bundeswehr Muenchen, commonName=San-Netz CA - G01 | yes | expired | 2014-09-23 to 2019-07-06 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 599 | countryName=DE, stateOrProvinceName=Saarland, localityName=Wadern, organizationName=Schloss Dagstuhl - LZI GmbH, organizationalUnitName=IT-Abteilung, commonName=Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress=pki@dagstuhl.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 600 | countryName=DE, stateOrProvinceName=Saarland, localityName=Wadern, organizationName=Schloss Dagstuhl - LZI GmbH, organizationalUnitName=IT-Abteilung, commonName=Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress=pki@dagstuhl.de | yes | expired | 2010-05-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 601 | countryName=DE, organizationName=Land Berlin, organizationalUnitName=Senatsverwaltung, commonName=Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress=pki@schule.berlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 602 | countryName=DE, organizationName=Land Berlin, organizationalUnitName=Senatsverwaltung, commonName=Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress=pki@schule.berlin.de | yes | expired | 2011-04-01 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 603 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=Shared Business CA 2 | yes | revoked, expired | 2010-07-14 to 2019-07-09 | 1.3.6.1.4.1.7879.13.25 | 1 | - | clean |
| 604 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=Shared Business CA 3 | yes | expired | 2012-09-04 to 2019-07-09 | 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2 | 0 | - | historical errors: 1 |
| 605 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=Shared Business CA 4 | yes | expired | 2014-02-11 to 2019-07-09 | 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2 | 0 | - | clean |
| 606 | countryName=DE, organizationName=SRH Hochschule Heidelberg der SRH Hochschulen GmbH, commonName=SRH Hochschule Heidelberg CA-G01, emailAddress=ca@fh-heidelberg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 607 | countryName=DE, organizationName=SRH Hochschule Heidelberg der SRH Hochschulen GmbH, commonName=SRH Hochschule Heidelberg CA-G01, emailAddress=ca@fh-heidelberg.de | yes | expired | 2011-01-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 608 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=STIFTUNG PREUSSISCHER KULTURBESITZ, commonName=STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress=ca@hv.spk-berlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 609 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=STIFTUNG PREUSSISCHER KULTURBESITZ, commonName=STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress=ca@hv.spk-berlin.de | yes | expired | 2008-09-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 610 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=subito. Dokumente aus Bibliotheken e.V., organizationalUnitName=Business Office, commonName=subito. Dokumente aus Bibliotheken e.V. CA - G01 | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 611 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=subito. Dokumente aus Bibliotheken e.V., organizationalUnitName=Business Office, commonName=subito. Dokumente aus Bibliotheken e.V. CA - G01 | yes | expired | 2012-08-03 to 2019-06-30 | 2.5.29.32.0 | 1 | - | clean |
| 612 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=T-Systems International GmbH, organizationalUnitName=ICTS, commonName=T-Systems International GmbH CA - G01, emailAddress=pki@atriumberlin.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 613 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=T-Systems International GmbH, organizationalUnitName=ICTS, commonName=T-Systems International GmbH CA - G01, emailAddress=pki@atriumberlin.de | yes | expired | 2010-03-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 614 | countryName=DE, organizationName=T-Systems SfR, commonName=T-Systems SfR CA, emailAddress=ca@t-systems-sfr.com | yes | expired | 2007-01-09 to 2018-11-30 | - | - | - | historical errors: 1 |
| 615 | countryName=DE, organizationName=T-Systems SfR, commonName=T-Systems SfR CA | yes | revoked, expired | 2007-01-08 to 2018-11-30 | - | - | - | historical errors: 1 |
| 616 | countryName=DE, organizationName=T-Systems SfR GmbH, commonName=T-Systems SfR CA 2, emailAddress=ca@t-systems-sfr.com | yes | expired | 2008-10-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 617 | countryName=DE, organizationName=T-Systems SfR GmbH, commonName=T-Systems SfR CA 2, emailAddress=ca@t-systems-sfr.com | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 618 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=Systems Integration Region 1 Standort Berlin, commonName=T-Systems SI CA, emailAddress=pki@atriumberlin.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 619 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=Systems Integration Region 1 Standort Berlin, commonName=T-Systems SI CA, emailAddress=pki@atriumberlin.de | yes | expired | 2007-06-19 to 2019-06-18 | - | 1 | - | historical errors: 1 |
| 620 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec Extended Validation SSL CA Class 3 | yes | expired | 2008-10-01 to 2018-10-01 | 2.5.29.32.0 | 0 | - | clean |
| 621 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalCA Class 2 | yes | expired | 2008-10-01 to 2018-10-01 | 2.5.29.32.0 | 0 | - | clean |
| 622 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2 | yes | expired | 2016-04-25 to 2019-07-09 | 1.3.6.1.4.1.7879.13.21 | - | - | historical errors: 1 |
| 623 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2 | yes | expired | 2008-10-01 to 2018-10-01 | 2.5.29.32.0 | - | - | clean |
| 624 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3 | yes | expired | 2008-10-01 to 2018-10-01 | 2.5.29.32.0 | - | - | clean |
| 625 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Technische Fachhochschule Georg Agricola zu Bochum, commonName=Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress=ca@tfh-bochum.de | yes | expired | 2007-09-04 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 626 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Technische Fachhochschule Georg Agricola zu Bochum, commonName=Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress=ca@tfh-bochum.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 627 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Technische Universitaet Braunschweig, commonName=Technische Universitaet Braunschweig CA, emailAddress=pki@tu-bs.de | yes | expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 628 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Technische Universitaet Braunschweig, commonName=Technische Universitaet Braunschweig CA, emailAddress=pki@tu-bs.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 629 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security BusinessID SMIME CA 2023 | yes | current | 2023-06-20 to 2033-06-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 630 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV ECC CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 631 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 21 | yes | revoked | 2021-04-21 to 2031-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 632 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 22 | yes | current | 2022-02-22 to 2032-02-22 | 2.23.140.1.2.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 633 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 634 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV ECC CA 21 | yes | current | 2021-04-21 to 2031-04-21 | 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 635 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV ECC CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.1, 0.4.0.194112.1.4 | 0 | TLS Web Server Authentication | current errors: 1 |
| 636 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 22 | yes | revoked | 2022-06-21 to 2032-06-21 | 2.23.140.1.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 637 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 23 | yes | current | 2023-03-28 to 2033-03-27 | 2.23.140.1.1, 0.4.0.194112.1.4 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 638 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 23A | yes | current | 2023-06-20 to 2033-06-19 | 2.23.140.1.1, 0.4.0.194112.1.4 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 639 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 25 | yes | current | 2025-02-27 to 2035-02-26 | 2.23.140.1.1, 0.4.0.194112.1.4 | 0 | TLS Web Server Authentication | clean |
| 640 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV ECC CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 641 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV ECC CA 26 | yes | current | 2026-03-19 to 2029-03-18 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 642 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV ECC qCA 25 | yes | revoked | 2025-07-08 to 2035-07-07 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 643 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV ECC qualified CA 25 | yes | current | 2025-10-23 to 2035-10-22 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | current errors: 1 |
| 644 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV qCA 25 | yes | revoked | 2025-07-08 to 2033-09-30 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | clean |
| 645 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV qualified CA 25 | yes | current | 2025-10-23 to 2033-09-30 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | clean |
| 646 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA CA 22 | yes | current | 2022-06-21 to 2032-06-21 | 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 647 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA CA 24 | yes | current | 2024-11-26 to 2034-11-25 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 648 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA CA 26A | yes | current | 2026-03-19 to 2029-03-18 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 649 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA CA 26B | yes | current | 2026-03-19 to 2029-03-18 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 650 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA qCA 25 | yes | revoked | 2025-07-08 to 2035-07-07 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | clean |
| 651 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA qualified CA 25 | yes | current | 2025-10-23 to 2035-10-22 | 2.23.140.1.2.2, 0.4.0.194112.1.5 | 0 | TLS Web Server Authentication | clean |
| 652 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security ServerID EV Class 3 CA | yes | current | 2022-08-02 to 2027-08-02 | 2.23.140.1.1, 0.4.0.194112.1.4 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 653 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security ServerID OV Class 2 CA | yes | current | 2022-08-02 to 2027-08-02 | 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 654 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME CA 25 | yes | current | 2025-02-27 to 2033-09-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 655 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC CA 23 | yes | current | 2023-03-28 to 2033-03-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 656 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC CA 24 | yes | current | 2024-02-13 to 2034-02-12 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 657 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC qCA 25 | yes | revoked | 2025-07-08 to 2035-07-07 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 658 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME qCA 25 | yes | revoked | 2025-07-08 to 2033-09-30 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 659 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA CA 23 | yes | current | 2023-03-28 to 2033-03-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 660 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA CA 24 | yes | current | 2024-02-13 to 2034-02-12 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 661 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA qCA 25 | yes | revoked | 2025-07-08 to 2035-07-07 | 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1 | 0 | E-mail Protection | clean |
| 662 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020 | yes | current | 2026-03-19 to 2033-09-30 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 663 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023 | yes | current | 2026-03-19 to 2033-09-30 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 664 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec Business CA 1 | yes | expired | 2012-11-29 to 2024-11-29 | 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2 | 0 | - | historical errors: 1 |
| 665 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec Business CA 20 G2 | yes | revoked | 2017-03-09 to 2027-03-09 | 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2 | 0 | - | clean |
| 666 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business CA 2021 | yes | revoked | 2021-11-17 to 2031-11-17 | 0.4.0.2042.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 667 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business CA 21 | yes | current | 2021-11-17 to 2031-11-17 | 0.4.0.2042.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 668 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 2021 | yes | revoked | 2021-11-17 to 2031-11-17 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 669 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 2022 | yes | current | 2022-06-21 to 2032-06-21 | 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 670 | countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 21 | yes | revoked | 2021-11-17 to 2031-11-17 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 671 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 2 G2 | yes | revoked | 2019-02-12 to 2029-02-12 | 1.3.6.1.4.1.7879.13.23 | - | - | clean |
| 672 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 2 G2 | yes | revoked, expired | 2016-02-23 to 2026-02-23 | 1.3.6.1.4.1.7879.13.23 | - | - | historical errors: 1 |
| 673 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 3 G2 | yes | revoked, expired | 2016-02-23 to 2026-02-23 | 1.3.6.1.4.1.7879.13.24 | - | - | historical errors: 1 |
| 674 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 3 G2 | yes | revoked | 2019-02-12 to 2029-02-12 | 1.3.6.1.4.1.7879.13.24 | - | - | clean |
| 675 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 4:PN | yes | revoked, expired | 2009-03-30 to 2019-03-30 | 1.3.6.1.4.1.7879.13.27 | - | - | clean |
| 676 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 5:PN | yes | revoked, expired | 2009-03-30 to 2019-03-30 | 1.3.6.1.4.1.7879.13.27 | - | - | clean |
| 677 | countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 6:PN | yes | revoked, expired | 2009-03-30 to 2019-03-30 | 1.3.6.1.4.1.7879.13.27 | - | - | clean |
| 678 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=TeleSec PKS CA 7:PN | yes | revoked, expired | 2010-07-14 to 2019-07-09 | 1.3.6.1.4.1.7879.13.27 | - | - | clean |
| 679 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=TeleSec PKS CA 7:PN | yes | expired | 2016-06-09 to 2019-07-09 | 1.3.6.1.4.1.7879.13.27 | - | - | historical errors: 2 |
| 680 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec PKS CA 8 | yes | revoked | 2019-03-20 to 2033-10-01 | 1.3.6.1.4.1.7879.13.27 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login | historical errors: 1 |
| 681 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass Class 2 CA | yes | expired | 2014-02-11 to 2024-02-11 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 682 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=NRW, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass DE-1 | yes | revoked, expired | 2013-03-01 to 2019-07-09 | 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2 | 0 | - | clean |
| 683 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass DE-2 | yes | expired | 2014-02-11 to 2019-07-09 | 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2 | 0 | - | clean |
| 684 | countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass Extended Validation Class 3 CA | yes | expired | 2014-02-11 to 2024-02-11 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 685 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Technische Fachhochschule Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=TFH Berlin CA, emailAddress=pki@tfh-berlin.de | yes | expired | 2007-10-30 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 686 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Fachhochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TFH Wildau CA, emailAddress=pki@tfh-wildau.de | yes | expired | 2009-06-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 687 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Hochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TH Wildau CA, emailAddress=pki@tfh-wildau.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 688 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Hochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TH Wildau CA, emailAddress=pki@tfh-wildau.de | yes | expired | 2010-06-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 689 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Friedensau, organizationName=Theologische Hochschule Friedensau, commonName=ThH Friedensau CA, emailAddress=pki@thh-friedensau.de | yes | expired | 2011-11-16 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 690 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Friedensau, organizationName=Theologische Hochschule Friedensau, commonName=ThH Friedensau CA, emailAddress=pki@thh-friedensau.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 691 | countryName=DE, organizationName=Thuenen-Institut, commonName=Thuenen-Institut CA - G01, emailAddress=ca@ti.bund.de | yes | expired | 2014-04-28 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 692 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Stiftung Tieraerztliche Hochschule Hannover, commonName=TiHo Hannover CA, emailAddress=ca@tiho-hannover.de | yes | expired | 2007-09-11 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 693 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Stiftung Tieraerztliche Hochschule Hannover, commonName=TiHo Hannover CA, emailAddress=ca@tiho-hannover.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 694 | countryName=DE, organizationName=Technische Universitaet Bergakademie Freiberg, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress=tubaf-ca@tu-freiberg.de | yes | expired | 2007-07-13 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 695 | countryName=DE, organizationName=Technische Universitaet Bergakademie Freiberg, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress=tubaf-ca@tu-freiberg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 696 | countryName=DE, organizationName=Technische Universitaet Chemnitz, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress=ca@tu-chemnitz.de | yes | expired | 2007-01-25 to 2019-01-15 | - | - | - | historical errors: 1 |
| 697 | countryName=DE, organizationName=Technische Universitaet Chemnitz, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress=ca@tu-chemnitz.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 698 | countryName=DE, organizationName=Technische Universitaet Clausthal, organizationalUnitName=Rechenzentrum, commonName=TU Clausthal CA - G02, emailAddress=pki@rz.tu-clausthal.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 699 | countryName=DE, organizationName=Technische Universitaet Clausthal, organizationalUnitName=Rechenzentrum, commonName=TU Clausthal CA - G02, emailAddress=pki@rz.tu-clausthal.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 700 | countryName=DE, organizationName=Technische Universitaet Dortmund, organizationalUnitName=ITMC, commonName=TU Dortmund CA - G01, emailAddress=ca@pki.tu-dortmund.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 701 | countryName=DE, organizationName=Technische Universitaet Dortmund, organizationalUnitName=ITMC, commonName=TU Dortmund CA - G01, emailAddress=ca@pki.tu-dortmund.de | yes | expired | 2008-05-09 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 702 | countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA, emailAddress=chipcard-ca@pki.tu-dortmund.de | yes | expired | 2008-08-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 703 | countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA, emailAddress=chipcard-ca@pki.tu-dortmund.de | yes | expired | 2015-01-13 to 2019-07-09 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 704 | countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA 2 | yes | current | 2016-06-15 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 705 | countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Technische Universitaet Dresden, commonName=TU Dresden CA | yes | current | 2016-12-12 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 706 | countryName=DE, organizationName=Technische Universitaet Dresden, organizationalUnitName=ZIH, commonName=TU Dresden CA - G02, emailAddress=pki@tu-dresden.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 707 | countryName=DE, organizationName=Technische Universitaet Dresden, organizationalUnitName=ZIH, commonName=TU Dresden CA - G02, emailAddress=pki@tu-dresden.de | yes | expired | 2007-06-19 to 2019-06-18 | - | 1 | - | historical errors: 1 |
| 708 | countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA, emailAddress=pki@tu-ilmenau.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 709 | countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA, emailAddress=pki@tu-ilmenau.de | yes | expired | 2009-02-17 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 710 | countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA G2 | yes | current | 2016-07-07 to 2031-02-22 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 711 | countryName=DE, organizationName=Technische Universitaet Berlin, commonName=TUB-CA, emailAddress=ca@TU-Berlin.DE | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 712 | countryName=DE, organizationName=Technische Universitaet Berlin, commonName=TUB-CA, emailAddress=ca@TU-Berlin.DE | yes | expired | 2007-10-01 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 713 | countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA G01, emailAddress=tud-ca@hrz.tu-darmstadt.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 714 | countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA G01, emailAddress=tud-ca@hrz.tu-darmstadt.de | yes | expired | 2007-07-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 715 | countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA P01, emailAddress=tud-ca@hrz.tu-darmstadt.de | yes | expired | 2010-09-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 716 | countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA P01, emailAddress=tud-ca@hrz.tu-darmstadt.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 717 | countryName=DE, organizationName=Technische Universitaet Hamburg-Harburg, organizationalUnitName=Rechenzentrum, commonName=TUHH CA in DFN-PKI Global - G01, emailAddress=tuhh-dfnpki-ra@tu-harburg.de | yes | expired | 2008-09-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 718 | countryName=DE, organizationName=Technische Universitaet Hamburg-Harburg, organizationalUnitName=Rechenzentrum, commonName=TUHH CA in DFN-PKI Global - G01, emailAddress=tuhh-dfnpki-ra@tu-harburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 719 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=TuTech Innovation GmbH, commonName=TuTech Innovation GmbH, emailAddress=ca@tutech.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 720 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=TuTech Innovation GmbH, commonName=TuTech Innovation GmbH, emailAddress=ca@tutech.de | yes | expired | 2008-09-10 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 721 | countryName=DE, stateOrProvinceName=Bayern, localityName=Augsburg, organizationName=Universitaet Augsburg, organizationalUnitName=Rechenzentrum, commonName=UAUX-CA, emailAddress=ca-admin@rz.uni-augsburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 722 | countryName=DE, stateOrProvinceName=Bayern, localityName=Augsburg, organizationName=Universitaet Augsburg, organizationalUnitName=Rechenzentrum, commonName=UAUX-CA, emailAddress=ca-admin@rz.uni-augsburg.de | yes | expired | 2008-04-24 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 723 | countryName=DE, organizationName=Universitaet der Kuenste Berlin, commonName=UdK Berlin CA, emailAddress=pki@udk-berlin.de | yes | expired | 2007-07-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 724 | countryName=DE, organizationName=Universitaet der Kuenste Berlin, commonName=UdK Berlin CA, emailAddress=pki@udk-berlin.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 725 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Universitaet Hamburg, organizationalUnitName=Regionales Rechenzentrum, commonName=UHH CA - G02, emailAddress=uhh-ca@uni-hamburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 726 | countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Universitaet Hamburg, organizationalUnitName=Regionales Rechenzentrum, commonName=UHH CA - G02, emailAddress=uhh-ca@uni-hamburg.de | yes | expired | 2007-08-14 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 727 | countryName=DE, stateOrProvinceName=Hessen, localityName=Giessen, organizationName=Universitaetsklinikum Giessen und Marburg GmbH, organizationalUnitName=Standort Marburg, organizationalUnitName=Zentrale Informationsverarbeitung (ZIV), commonName=UKGM CA - G01, emailAddress=ca@uniklinikum-marburg.de | yes | expired | 2014-09-29 to 2019-07-08 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 728 | countryName=DE, organizationName=Umweltbundesamt, commonName=Umweltbundesamt CA - G01 | yes | expired | 2014-10-28 to 2019-07-09 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | clean |
| 729 | countryName=DE, organizationName=Otto-Friedrich-Universitaet Bamberg, organizationalUnitName=Rechenzentrum, commonName=Uni Bamberg CA - G02, emailAddress=pki@urz.uni-bamberg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 730 | countryName=DE, organizationName=Otto-Friedrich-Universitaet Bamberg, organizationalUnitName=Rechenzentrum, commonName=Uni Bamberg CA - G02, emailAddress=pki@urz.uni-bamberg.de | yes | expired | 2007-03-27 to 2019-03-26 | - | - | - | historical errors: 1 |
| 731 | countryName=DE, organizationName=Universitaet Dortmund, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Dortmund CA - G01, emailAddress=ca@pki.uni-dortmund.de | yes | expired | 2007-01-30 to 2019-01-29 | - | - | - | historical errors: 1 |
| 732 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Duesseldorf, organizationName=Heinrich-Heine-Universitaet Duesseldorf, commonName=Uni Duesseldorf CA-G01, emailAddress=ca@uni-duesseldorf.de | yes | expired | 2009-06-19 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 733 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Duesseldorf, organizationName=Heinrich-Heine-Universitaet Duesseldorf, commonName=Uni Duesseldorf CA-G01, emailAddress=ca@uni-duesseldorf.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 734 | countryName=DE, organizationName=Universitaet Flensburg, organizationalUnitName=ZIMT, commonName=Uni Flensburg CA, emailAddress=ca@uni-flensburg.de | yes | expired | 2008-07-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 735 | countryName=DE, organizationName=Universitaet Flensburg, organizationalUnitName=ZIMT, commonName=Uni Flensburg CA, emailAddress=ca@uni-flensburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 736 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle (Saale), organizationName=Martin-Luther-Universitaet Halle-Wittenberg, commonName=Uni Halle Chipcard CA, emailAddress=pki@uni-halle.de | yes | expired | 2009-12-15 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 737 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle (Saale), organizationName=Martin-Luther-Universitaet Halle-Wittenberg, commonName=Uni Halle Chipcard CA, emailAddress=pki@uni-halle.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 738 | countryName=DE, organizationName=Universitaet Hildesheim, organizationalUnitName=Rechenzentrum, commonName=Uni Hildesheim CA, emailAddress=unihica@uni-hildesheim.de | yes | expired | 2008-01-11 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 739 | countryName=DE, organizationName=Universitaet Hildesheim, organizationalUnitName=Rechenzentrum, commonName=Uni Hildesheim CA, emailAddress=unihica@uni-hildesheim.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 740 | countryName=DE, organizationName=Universitaet Kassel, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress=ca@uni-kassel.de | yes | expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 741 | countryName=DE, organizationName=Universitaet Kassel, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress=ca@uni-kassel.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 742 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Kiel, organizationName=Universitaet Kiel, organizationalUnitName=Rechenzentrum, commonName=Uni Kiel CA - G02, emailAddress=pki@uni-kiel.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 743 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Kiel, organizationName=Universitaet Kiel, organizationalUnitName=Rechenzentrum, commonName=Uni Kiel CA - G02, emailAddress=pki@uni-kiel.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 744 | countryName=DE, organizationName=Otto-von-Guericke-Universitaet Magdeburg, commonName=Uni Magdeburg CA, emailAddress=ca@uni-magdeburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 745 | countryName=DE, organizationName=Otto-von-Guericke-Universitaet Magdeburg, commonName=Uni Magdeburg CA, emailAddress=ca@uni-magdeburg.de | yes | expired | 2007-02-01 to 2019-01-31 | - | - | - | historical errors: 1 |
| 746 | countryName=DE, organizationName=Universitaet Marburg, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Marburg CA - G02, emailAddress=pki@uni-marburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 747 | countryName=DE, organizationName=Universitaet Marburg, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Marburg CA - G02, emailAddress=pki@uni-marburg.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 748 | countryName=DE, stateOrProvinceName=Bayern, localityName=Regensburg, organizationName=Universitaet Regensburg, commonName=Uni Regensburg CA - G01, emailAddress=pki@uni-regensburg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 749 | countryName=DE, stateOrProvinceName=Bayern, localityName=Regensburg, organizationName=Universitaet Regensburg, commonName=Uni Regensburg CA - G01, emailAddress=pki@uni-regensburg.de | yes | expired | 2008-04-21 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 750 | countryName=DE, organizationName=Universitaet Rostock, organizationalUnitName=Rechenzentrum, commonName=Uni Rostock CA - G02, emailAddress=ca@uni-rostock.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 751 | countryName=DE, organizationName=Universitaet Rostock, organizationalUnitName=Rechenzentrum, commonName=Uni Rostock CA - G02, emailAddress=ca@uni-rostock.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 752 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Witten, organizationName=Private Universitaet Witten/Herdecke gGmbH, organizationalUnitName=BIT, commonName=Uni Witten/Herdecke CA - G01, emailAddress=ca@uni-wh.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 753 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Witten, organizationName=Private Universitaet Witten/Herdecke gGmbH, organizationalUnitName=BIT, commonName=Uni Witten/Herdecke CA - G01, emailAddress=ca@uni-wh.de | yes | expired | 2012-05-30 to 2019-06-30 | - | 1 | - | clean |
| 754 | countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt am Main, organizationName=Johann Wolfgang Goethe-Universitaet, commonName=UNI-FFM CA, emailAddress=ca@uni-frankfurt.de | yes | expired | 2009-05-18 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 755 | countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt am Main, organizationName=Johann Wolfgang Goethe-Universitaet, commonName=UNI-FFM CA, emailAddress=ca@uni-frankfurt.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 756 | countryName=DE, organizationName=Universitaet Freiburg, organizationalUnitName=Rechenzentrum, commonName=Uni-FR CA - G02, emailAddress=pki@rz.uni-freiburg.de | yes | expired | 2007-03-06 to 2019-03-05 | - | - | - | historical errors: 1 |
| 757 | countryName=DE, organizationName=Universitaet Freiburg, organizationalUnitName=Rechenzentrum, commonName=Uni-FR CA - G02, emailAddress=pki@rz.uni-freiburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 758 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Universitaet Heidelberg, organizationalUnitName=uni, commonName=Uni-HD2-CA, emailAddress=pki@urz.uni-heidelberg.de | yes | expired | 2008-05-23 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 759 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Universitaet Heidelberg, organizationalUnitName=uni, commonName=Uni-HD2-CA, emailAddress=pki@urz.uni-heidelberg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 760 | countryName=DE, organizationName=Uni-Konstanz, commonName=Uni-Konstanz CA-S001, emailAddress=ca@uni-konstanz.de | yes | expired | 2007-02-13 to 2019-02-12 | - | - | - | historical errors: 1 |
| 761 | countryName=DE, organizationName=Uni-Konstanz, commonName=Uni-Konstanz CA-S001, emailAddress=ca@uni-konstanz.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 762 | countryName=DE, organizationName=Universitaet Osnabrueck, organizationalUnitName=Rechenzentrum, commonName=Uni-Osnabrueck RZ-CA G-002, emailAddress=ca@uni-osnabrueck.de | yes | expired | 2007-06-19 to 2019-06-18 | - | 1 | - | historical errors: 1 |
| 763 | countryName=DE, organizationName=Universitaet Osnabrueck, organizationalUnitName=Rechenzentrum, commonName=Uni-Osnabrueck RZ-CA G-002, emailAddress=ca@uni-osnabrueck.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 764 | countryName=DE, organizationName=Universitaet Siegen, organizationalUnitName=Zentrum fuer Informations- und Medientechnologie, commonName=Uni-Siegen CA - G02 | yes | expired | 2007-03-14 to 2019-03-13 | - | - | - | historical errors: 1 |
| 765 | countryName=DE, organizationName=Universitaet Siegen, organizationalUnitName=Zentrum fuer Informations- und Medientechnologie, commonName=Uni-Siegen CA - G02 | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 766 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Wuppertal, organizationName=Bergische Universitaet Wuppertal, organizationalUnitName=ZIM, commonName=Uni-Wuppertal CA, emailAddress=pki@uni-wuppertal.de | yes | expired | 2007-10-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 767 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Wuppertal, organizationName=Bergische Universitaet Wuppertal, organizationalUnitName=ZIM, commonName=Uni-Wuppertal CA, emailAddress=pki@uni-wuppertal.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 768 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Universitaet Hohenheim, commonName=Uni. Hohenheim CA - G01, emailAddress=rz-pki@uni-hohenheim.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 769 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Universitaet Hohenheim, commonName=Uni. Hohenheim CA - G01, emailAddress=rz-pki@uni-hohenheim.de | yes | expired | 2008-08-22 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 770 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Universitaet der Bundeswehr Muenchen, commonName=UniBwM CA-G01, emailAddress=pki@unibw.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 771 | countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Universitaet der Bundeswehr Muenchen, commonName=UniBwM CA-G01, emailAddress=pki@unibw.de | yes | expired | 2008-03-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 772 | countryName=DE, organizationName=Universitaet Karlsruhe, commonName=UNIKA-CA, emailAddress=ca@uni-karlsruhe.de | yes | expired | 2007-09-25 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 773 | countryName=DE, localityName=Koeln, organizationName=Universitaet zu Koeln, commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de | yes | expired | 2007-04-18 to 2019-04-17 | - | 1 | - | historical errors: 1 |
| 774 | countryName=DE, localityName=Koeln, organizationName=Universitaet zu Koeln, commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de | yes | expired | 2014-05-19 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 775 | countryName=DE, organizationName=Universitaet zu Koeln, organizationalUnitName=Zentrum fuer Angewandte Informatik (ZAIK), commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de | yes | revoked, expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 776 | countryName=DE, organizationName=Universitaet Bayreuth, commonName=Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress=CA@Uni-Bayreuth.DE | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 777 | countryName=DE, organizationName=Universitaet Bayreuth, commonName=Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress=CA@Uni-Bayreuth.DE | yes | expired | 2009-11-04 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 778 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Universitaet Bonn, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Bonn CA, emailAddress=caadmin@uni-bonn.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 779 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Universitaet Bonn, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Bonn CA, emailAddress=caadmin@uni-bonn.de | yes | expired | 2008-04-03 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 780 | countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Universitaet Bremen, commonName=Universitaet Bremen CA | yes | expired | 2007-03-08 to 2019-03-07 | - | - | - | historical errors: 1 |
| 781 | countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Universitaet Bremen, commonName=Universitaet Bremen CA | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 782 | countryName=DE, organizationName=Universitaet Duisburg-Essen, organizationalUnitName=Zentrum fuer Informations- und Mediendienste, commonName=Universitaet Duisburg-Essen CA -G01, emailAddress=caadmin@uni-duisburg-essen.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 783 | countryName=DE, organizationName=Universitaet Duisburg-Essen, organizationalUnitName=Zentrum fuer Informations- und Mediendienste, commonName=Universitaet Duisburg-Essen CA -G01, emailAddress=caadmin@uni-duisburg-essen.de | yes | expired | 2008-04-08 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 784 | countryName=DE, organizationName=Universitaet Erfurt, commonName=Universitaet Erfurt CA - G01, emailAddress=pki@uni-erfurt.de | yes | expired | 2007-07-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 785 | countryName=DE, organizationName=Universitaet Erfurt, commonName=Universitaet Erfurt CA - G01, emailAddress=pki@uni-erfurt.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 786 | countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen C CA - G01, emailAddress=unigi-ca@uni-giessen.de | yes | expired | 2015-01-13 to 2019-07-09 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |
| 787 | countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen C CA - G01, emailAddress=unigi-ca@uni-giessen.de | yes | expired | 2010-08-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 788 | countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen S CA - G01, emailAddress=unigi-ca@uni-giessen.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 789 | countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen S CA - G01, emailAddress=unigi-ca@uni-giessen.de | yes | expired | 2007-03-07 to 2019-03-06 | - | - | - | historical errors: 1 |
| 790 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle, organizationName=Martin-Luther-Universitaet Halle-Wittenberg, organizationalUnitName=URZ, commonName=Universitaet Halle CA, emailAddress=pki@uni-halle.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 791 | countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle, organizationName=Martin-Luther-Universitaet Halle-Wittenberg, organizationalUnitName=URZ, commonName=Universitaet Halle CA, emailAddress=pki@uni-halle.de | yes | expired | 2007-06-20 to 2019-06-19 | - | 1 | - | historical errors: 1 |
| 792 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Universitaet Jena, commonName=Universitaet Jena CA - G01, emailAddress=pki@uni-jena.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 793 | countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Universitaet Jena, commonName=Universitaet Jena CA - G01, emailAddress=pki@uni-jena.de | yes | expired | 2007-07-12 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 794 | countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de | yes | revoked, expired | 2007-01-31 to 2019-01-30 | - | - | - | historical errors: 1 |
| 795 | countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de | yes | expired | 2007-01-31 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 796 | countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de | yes | expired | 2007-01-31 to 2019-01-30 | - | 1 | - | historical errors: 1 |
| 797 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Oldenburg, organizationName=Universitaet Oldenburg, organizationalUnitName=IT-Dienste, commonName=Universitaet Oldenburg PKI, emailAddress=pki@uni-oldenburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 798 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Oldenburg, organizationName=Universitaet Oldenburg, organizationalUnitName=IT-Dienste, commonName=Universitaet Oldenburg PKI, emailAddress=pki@uni-oldenburg.de | yes | expired | 2010-06-22 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 799 | countryName=DE, organizationName=Universitaet Paderborn, organizationalUnitName=IMT (Zentrum fuer Informations- und Medientechnologien), commonName=Universitaet Paderborn CA - G01, emailAddress=ca@uni-paderborn.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 800 | countryName=DE, organizationName=Universitaet Paderborn, organizationalUnitName=IMT (Zentrum fuer Informations- und Medientechnologien), commonName=Universitaet Paderborn CA - G01, emailAddress=ca@uni-paderborn.de | yes | expired | 2007-12-20 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 801 | countryName=DE, localityName=Passau, organizationName=Universitaet Passau, organizationalUnitName=Rechenzentrum, commonName=Universitaet Passau CA - G01, emailAddress=ca@rz.uni-passau.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 802 | countryName=DE, localityName=Passau, organizationName=Universitaet Passau, organizationalUnitName=Rechenzentrum, commonName=Universitaet Passau CA - G01, emailAddress=ca@rz.uni-passau.de | yes | expired | 2007-02-19 to 2019-02-18 | - | - | - | historical errors: 1 |
| 803 | countryName=DE, localityName=Potsdam, organizationName=Universitaet Potsdam, commonName=Universitaet Potsdam CA - G01, emailAddress=pki-admin@uni-potsdam.de | yes | expired | 2007-11-07 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 804 | countryName=DE, localityName=Potsdam, organizationName=Universitaet Potsdam, commonName=Universitaet Potsdam CA - G01, emailAddress=pki-admin@uni-potsdam.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 805 | countryName=DE, localityName=Stuttgart, organizationName=Universitaet Stuttgart, commonName=Universitaet Stuttgart CA - G01, emailAddress=ca-g01@uni-stuttgart.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 806 | countryName=DE, localityName=Stuttgart, organizationName=Universitaet Stuttgart, commonName=Universitaet Stuttgart CA - G01, emailAddress=ca-g01@uni-stuttgart.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 807 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Universitaet Vechta, organizationalUnitName=Kommunikations- und Informationszentrum, commonName=Universitaet Vechta CA - G01, emailAddress=pki@uni-vechta.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 808 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Universitaet Vechta, organizationalUnitName=Kommunikations- und Informationszentrum, commonName=Universitaet Vechta CA - G01, emailAddress=pki@uni-vechta.de | yes | expired | 2012-04-04 to 2019-06-30 | - | 1 | - | clean |
| 809 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Goettingen, organizationName=Georg-August-Universitaet Goettingen, commonName=Universitaet-Goettingen CA, emailAddress=gwdg-ca@gwdg.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 810 | countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Goettingen, organizationName=Georg-August-Universitaet Goettingen, commonName=Universitaet-Goettingen CA, emailAddress=gwdg-ca@gwdg.de | yes | expired | 2007-07-31 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 811 | countryName=DE, organizationName=Universitaetsklinikum Freiburg, organizationalUnitName=Klinikrechenzentrum, commonName=Universitaetsklinikum Freiburg CA - G01, emailAddress=pki@uniklinik-freiburg.de | yes | expired | 2012-06-19 to 2019-06-30 | - | 1 | - | clean |
| 812 | countryName=DE, organizationName=Universitaetsklinikum Freiburg, organizationalUnitName=Klinikrechenzentrum, commonName=Universitaetsklinikum Freiburg CA - G01, emailAddress=pki@uniklinik-freiburg.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 813 | countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Universitaetsmedizin der Johannes Gutenberg-Universitaet Mainz, commonName=UNIVERSITAETSmedizin. Mainz - CA - G01, emailAddress=ca@unimedizin-mainz.de | yes | expired | 2014-07-11 to 2019-07-06 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 814 | countryName=DE, organizationName=Universitaet Wuerzburg, commonName=UNIWUE-CA - G01, emailAddress=ca@uni-wuerzburg.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 815 | countryName=DE, organizationName=Universitaet Wuerzburg, commonName=UNIWUE-CA - G01, emailAddress=ca@uni-wuerzburg.de | yes | expired | 2007-03-07 to 2019-03-06 | - | - | - | historical errors: 1 |
| 816 | countryName=DE, organizationName=Westsaechsische Hochschule Zwickau, commonName=WHZ Zwickau CA, emailAddress=WHZCA@fh-zwickau.de | yes | expired | 2008-03-26 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 817 | countryName=DE, organizationName=Westsaechsische Hochschule Zwickau, commonName=WHZ Zwickau CA, emailAddress=WHZCA@fh-zwickau.de | yes | expired | 2014-05-27 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 818 | countryName=DE, organizationName=Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, organizationalUnitName=DV, commonName=WZB CA, emailAddress=certs@wzb.eu | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 819 | countryName=DE, organizationName=Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, organizationalUnitName=DV, commonName=WZB CA, emailAddress=certs@wzb.eu | yes | expired | 2007-02-01 to 2019-01-31 | - | - | - | historical errors: 1 |
| 820 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Muencheberg, organizationName=Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., commonName=ZALF CA, emailAddress=pki@zalf.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 821 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Muencheberg, organizationName=Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., commonName=ZALF CA, emailAddress=pki@zalf.de | yes | expired | 2008-09-05 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 822 | countryName=DE, organizationName=ZBW - Leibniz-Informationszentrum Wirtschaft, commonName=ZBW CA - G01, emailAddress=ca@zbw.eu | yes | expired | 2012-12-13 to 2019-06-30 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 823 | countryName=DE, organizationName=ZBW - Leibniz-Informationszentrum Wirtschaft, commonName=ZBW CA - G01, emailAddress=ca@zbw.eu | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 824 | countryName=DE, organizationName=Technische Universitaet Muenchen, commonName=Zertifizierungsstelle der TUM | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | clean |
| 825 | countryName=DE, organizationName=Technische Universitaet Muenchen, commonName=Zertifizierungsstelle der TUM | yes | expired | 2007-02-13 to 2019-02-12 | - | - | - | historical errors: 1 |
| 826 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, organizationName=Universitaetsklinikum Schleswig-Holstein, organizationalUnitName=ITSG, commonName=Zertifizierungsstelle des UKSH, emailAddress=ca@uk-sh.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 827 | countryName=DE, stateOrProvinceName=Schleswig-Holstein, organizationName=Universitaetsklinikum Schleswig-Holstein, organizationalUnitName=ITSG, commonName=Zertifizierungsstelle des UKSH, emailAddress=ca@uk-sh.de | yes | expired | 2010-07-27 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 828 | countryName=DE, organizationName=FH Duesseldorf, organizationalUnitName=DVZ, commonName=Zertifizierungsstelle FH Duesseldorf - G02, emailAddress=pki@fh-duesseldorf.de | yes | expired | 2007-04-03 to 2019-04-02 | - | - | - | historical errors: 1 |
| 829 | countryName=DE, organizationName=FH Duesseldorf, organizationalUnitName=DVZ, commonName=Zertifizierungsstelle FH Duesseldorf - G02, emailAddress=pki@fh-duesseldorf.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 830 | countryName=DE, organizationName=Universitaet Muenster, commonName=Zertifizierungsstelle Universitaet Muenster - G02, emailAddress=ca@uni-muenster.de | yes | expired | 2007-02-26 to 2019-02-25 | - | - | - | historical errors: 1 |
| 831 | countryName=DE, organizationName=Universitaet Muenster, commonName=Zertifizierungsstelle Universitaet Muenster - G02, emailAddress=ca@uni-muenster.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 832 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), commonName=ZIB-CA, emailAddress=ca@zib.de | yes | expired | 2009-02-11 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 833 | countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), commonName=ZIB-CA, emailAddress=ca@zib.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 834 | countryName=DE, organizationName=Zentrum fuer Informationsverarbeitung und Informationstechnik, organizationalUnitName=Betrieb, commonName=ZIVIT CA - G01, emailAddress=ca@zivit.de | yes | expired | 2007-02-05 to 2019-02-04 | - | - | - | historical errors: 1 |
| 835 | countryName=DE, organizationName=Zentrum fuer Informationsverarbeitung und Informationstechnik, organizationalUnitName=Betrieb, commonName=ZIVIT CA - G01, emailAddress=ca@zivit.de | yes | expired | 2014-05-12 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 836 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Zentrum fuer Kunst und Medientechnologie Karlsruhe, organizationalUnitName=EDV, commonName=ZKM-EDV, emailAddress=edv@zkm.de | yes | expired | 2010-06-02 to 2019-06-30 | - | 1 | - | historical errors: 1 |
| 837 | countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Zentrum fuer Kunst und Medientechnologie Karlsruhe, organizationalUnitName=EDV, commonName=ZKM-EDV, emailAddress=edv@zkm.de | yes | expired | 2014-06-05 to 2019-07-09 | 2.5.29.32.0 | 1 | - | historical errors: 1 |
| 838 | countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Zentrum fuer Zeithistorische Forschung Potsdam e.V. (ZZF), commonName=ZZF Potsdam CA - G01, emailAddress=ca@zzf-pdm.de | yes | expired | 2015-03-12 to 2019-06-30 | 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4 | 1 | - | historical errors: 1 |

## Certificate Details

### Deutsche Telekom Root CA 2

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 26
- SHA-256: B6191A50D0C3977F7DA99BCDAAC86A227DAEB9679EC70BA3B0C9D92271C170D3
- SPKI SHA-256: D1DE2AE61C8DF2FA623966163D4C73D460BFC428E57585BE6BFEB9A56323D1B6
- Validity: 1999-07-09 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=775:cp-telesec-globalroot, https://www.telesec.de/en/public-key-infrastructure/support/cp-cps?download=776:cps-telesec-globalroot
- CP/CPS same as parent: false
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2019072606_Deutsche-Telekom-Root-CA-2_V1.0_s.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 5
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 38 (0x26)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jul  9 12:11:00 1999 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints:
                CA:TRUE, pathlen:5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B6191A50D0C3977F7DA99BCDAAC86A227DAEB9679EC70BA3B0C9D92271C170D3
    SPKI SHA256: D1DE2AE61C8DF2FA623966163D4C73D460BFC428E57585BE6BFEB9A56323D1B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":false,"ca":true,"path_len":5}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_basic_constraints_not_critical: Basic Constraints extension is marked as non-critical

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- is_expired

### T-TeleSec GlobalRoot Class 2

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 01
- SHA-256: 91E2F5788D5810EBA7BA58737DE1548A8ECACD014598BC0B143E041B17052552
- SPKI SHA-256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
- Validity: 2008-10-01 to 2033-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_SBR.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Oct  1 10:40:14 2008 GMT
            Not After : Oct  1 23:59:59 2033 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91E2F5788D5810EBA7BA58737DE1548A8ECACD014598BC0B143E041B17052552
    SPKI SHA256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### T-TeleSec GlobalRoot Class 3

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 01
- SHA-256: FD73DAD31C644FF1B43BEF0CCDDA96710B9CD9875ECA7E31707AF3E96D522BBD
- SPKI SHA-256: 8D767764B3CBDA08929D072A22A561F4DCDD1BC57D3CBDDC948C47D2B47F9122
- Validity: 2008-10-01 to 2033-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_EV.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Oct  1 10:29:56 2008 GMT
            Not After : Oct  1 23:59:59 2033 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FD73DAD31C644FF1B43BEF0CCDDA96710B9CD9875ECA7E31707AF3E96D522BBD
    SPKI SHA256: 8D767764B3CBDA08929D072A22A561F4DCDD1BC57D3CBDDC948C47D2B47F9122
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telekom Security SMIME ECC Root 2021

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 152ADD14C918D1A4564086A625AF075F
- SHA-256: 3AE6DF7E0D637A65A8C81612EC6F9A142F85A16834C10280D88E707028518755
- SPKI SHA-256: A507286FF73B0DF7D8B590E232BB2503EC5DF28500B1062ED4554C9B2514F2B4
- Validity: 2021-03-18 to 2046-03-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2023062101_Telekom_Security_2023_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_SBR.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            15:2a:dd:14:c9:18:d1:a4:56:40:86:a6:25:af:07:5f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Mar 18 11:08:30 2021 GMT
            Not After : Mar 17 23:59:59 2046 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3AE6DF7E0D637A65A8C81612EC6F9A142F85A16834C10280D88E707028518755
    SPKI SHA256: A507286FF73B0DF7D8B590E232BB2503EC5DF28500B1062ED4554C9B2514F2B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telekom Security SMIME RSA Root 2023

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: 0C7E62F579733B9D438E8B63ED9195B8
- SHA-256: 78A656344F947E9CC0F734D9053D32F6742086B6B9CD2CAE4FAE1A2E4EFDE048
- SPKI SHA-256: F0D9AA90A24374C43BEDA7717FD53CF050EA45129B13BE5E96A99BA1E3E116F0
- Validity: 2023-03-28 to 2048-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2023062101_Telekom_Security_2023_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_SBR.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:7e:62:f5:79:73:3b:9d:43:8e:8b:63:ed:91:95:b8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Mar 28 12:09:22 2023 GMT
            Not After : Mar 27 23:59:59 2048 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 78A656344F947E9CC0F734D9053D32F6742086B6B9CD2CAE4FAE1A2E4EFDE048
    SPKI SHA256: F0D9AA90A24374C43BEDA7717FD53CF050EA45129B13BE5E96A99BA1E3E116F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telekom Security TLS ECC Root 2020

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 363A968CC95CB258CDD0015DC5E55700
- SHA-256: 578AF4DED0853F4E5998DB4AEAF9CBEA8D945F60B620A38D1A3C13B2BC7BA8E1
- SPKI SHA-256: EAB0DE5A46419010B01B2D55553FC111AA82B43D9395EDFEAEAA8C76E6AD1995
- Validity: 2020-08-25 to 2045-08-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_EV.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:3a:96:8c:c9:5c:b2:58:cd:d0:01:5d:c5:e5:57:00
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Aug 25 07:48:20 2020 GMT
            Not After : Aug 25 23:59:59 2045 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 578AF4DED0853F4E5998DB4AEAF9CBEA8D945F60B620A38D1A3C13B2BC7BA8E1
    SPKI SHA256: EAB0DE5A46419010B01B2D55553FC111AA82B43D9395EDFEAEAA8C76E6AD1995
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telekom Security TLS RSA Root 2023

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 219C542DE8F6EC7177FA4EE8C3705797
- SHA-256: EFC65CADBB59ADB6EFE84DA22311B35624B71B3B1EA0DA8B6655174EC8978646
- SPKI SHA-256: 0E05E9BB23869EB689DC56839DCEC475A3AE75FA6B50BC5A4978360CBE673323
- Validity: 2023-03-28 to 2048-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-DE-V9.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V12.0.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_Standard.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_BR.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2026042801_Telekom_Security_2026_TLS_EV.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:9c:54:2d:e8:f6:ec:71:77:fa:4e:e8:c3:70:57:97
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Mar 28 12:16:45 2023 GMT
            Not After : Mar 27 23:59:59 2048 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EFC65CADBB59ADB6EFE84DA22311B35624B71B3B1EA0DA8B6655174EC8978646
    SPKI SHA256: 0E05E9BB23869EB689DC56839DCEC475A3AE75FA6B50BC5A4978360CBE673323
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Alfred-Wegener-Institut CA - G01

- Subject: countryName=DE, organizationName=Alfred-Wegener-Institut, commonName=Alfred-Wegener-Institut CA - G01, emailAddress=pki@awi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C37F230
- SHA-256: 9AC07E9B20809377A23E8913E72973F3C8458E541072E67D98577FDF62A12407
- SPKI SHA-256: 0F94251750AF039AC9B3878EE646919FFE5E0646B577D6AD1D40274720B6D521
- Validity: 2008-04-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 204993072 (0xc37f230)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 30 13:31:13 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Alfred-Wegener-Institut, CN = Alfred-Wegener-Institut CA - G01, emailAddress = pki@awi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                78:C0:99:CA:23:57:17:09:1B:C0:AD:50:C5:79:C1:20:A8:27:C8:5E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@awi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9AC07E9B20809377A23E8913E72973F3C8458E541072E67D98577FDF62A12407
    SPKI SHA256: 0F94251750AF039AC9B3878EE646919FFE5E0646B577D6AD1D40274720B6D521
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Alfred-Wegener-Institut CA - G01

- Subject: countryName=DE, organizationName=Alfred-Wegener-Institut, commonName=Alfred-Wegener-Institut CA - G01, emailAddress=pki@awi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424BDC03B0F
- SHA-256: D7401BB7C6AD8B3FE0254812CAEB1DDC34D9CCAA39B5680191C13948AB987815
- SPKI SHA-256: 0F94251750AF039AC9B3878EE646919FFE5E0646B577D6AD1D40274720B6D521
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402173614863 (0x17a424bdc03b0f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Alfred-Wegener-Institut, CN = Alfred-Wegener-Institut CA - G01, emailAddress = pki@awi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                78:C0:99:CA:23:57:17:09:1B:C0:AD:50:C5:79:C1:20:A8:27:C8:5E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@awi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7401BB7C6AD8B3FE0254812CAEB1DDC34D9CCAA39B5680191C13948AB987815
    SPKI SHA256: 0F94251750AF039AC9B3878EE646919FFE5E0646B577D6AD1D40274720B6D521
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ALP Dillingen CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d. Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F84CE241
- SHA-256: 4D668BB6060DDAA233F4715A6B4248C84E8063208AD74E42F98FCFA827EBDD25
- SPKI SHA-256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670621393473 (0x179060f84ce241)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:16 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Dillingen a.d. Donau, O = Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, OU = IT-Department, CN = ALP Dillingen CA, emailAddress = ca@alp.dillingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                24:94:8B:32:BB:D3:2D:43:FC:8F:0E:36:10:ED:EA:F9:93:EC:D8:D4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@alp.dillingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D668BB6060DDAA233F4715A6B4248C84E8063208AD74E42F98FCFA827EBDD25
    SPKI SHA256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ALP Dillingen CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d.Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A15EFD8
- SHA-256: 0F1BE8082493C09FF5534F56DBCBAF75B42C058A7E1118D2D5B9994132063037
- SPKI SHA-256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
- Validity: 2007-03-13 to 2019-03-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169209816 (0xa15efd8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 13 09:43:37 2007 GMT
            Not After : Mar 12 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Dillingen a.d.Donau, O = Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, OU = IT-Department, CN = ALP Dillingen CA, emailAddress = ca@alp.dillingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                24:94:8B:32:BB:D3:2D:43:FC:8F:0E:36:10:ED:EA:F9:93:EC:D8:D4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@alp.dillingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0F1BE8082493C09FF5534F56DBCBAF75B42C058A7E1118D2D5B9994132063037
    SPKI SHA256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ALP Dillingen CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Dillingen a.d.Donau, organizationName=Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, organizationalUnitName=IT-Department, commonName=ALP Dillingen CA, emailAddress=ca@alp.dillingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1799A01A2C3935
- SHA-256: 6949CDB388E26D2AD8A588E5A717A3585AEF6FDCB6F13BFCAFB4174FBF70236B
- SPKI SHA-256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
- Validity: 2014-05-19 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6642837377268021 (0x1799a01a2c3935)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 19 15:26:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Dillingen a.d.Donau, O = Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen, OU = IT-Department, CN = ALP Dillingen CA, emailAddress = ca@alp.dillingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                24:94:8B:32:BB:D3:2D:43:FC:8F:0E:36:10:ED:EA:F9:93:EC:D8:D4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@alp.dillingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6949CDB388E26D2AD8A588E5A717A3585AEF6FDCB6F13BFCAFB4174FBF70236B
    SPKI SHA256: 0E309BD766FE044B80A03317A5444E732F7ACDFA07D42FF5C94850442026958A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ASH BERLIN CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Alice-Salomon-Hochschule Berlin, organizationalUnitName=ComZ, commonName=ASH BERLIN CA - G01, emailAddress=ca@ash-berlin.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1930BAD4F92758
- SHA-256: 8C4482E8FD43103175A56651A89A45EFD3788000D850628C6D1AFC2B3E5E4172
- SPKI SHA-256: F1E301B41A215600EC9A08FCF1E490C4D69FF77A6E11195A1B38D153FF910BBD
- Validity: 2015-03-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7090453412915032 (0x1930bad4f92758)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 24 10:32:36 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Alice-Salomon-Hochschule Berlin, OU = ComZ, CN = ASH BERLIN CA - G01, emailAddress = ca@ash-berlin.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                D3:44:B9:A1:5F:DD:7C:31:65:E8:6F:29:13:AA:4D:1A:6B:CD:C6:FC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ash-berlin.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C4482E8FD43103175A56651A89A45EFD3788000D850628C6D1AFC2B3E5E4172
    SPKI SHA256: F1E301B41A215600EC9A08FCF1E490C4D69FF77A6E11195A1B38D153FF910BBD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Asse-GmbH CA - G01

- Subject: countryName=DE, organizationName=Asse-GmbH, commonName=Asse-GmbH CA - G01, emailAddress=ca.asse@asse-gmbh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94EAEC3A21
- SHA-256: 9498B3072DB2ECCFEB0F301FFCE15A08C65C0735ED3264AF22FBCB8B8C045035
- SPKI SHA-256: 66AE4923887B8C269B1B897E697EF0D109B1C6092C07EBA351A072C30C6E9A9A
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612003014326817 (0x177d94eaec3a21)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:50 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Asse-GmbH, CN = Asse-GmbH CA - G01, emailAddress = ca.asse@asse-gmbh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                09:DD:29:8D:2C:EE:C5:07:7D:A8:B4:70:A4:38:28:66:71:FF:03:C6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca.asse@asse-gmbh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9498B3072DB2ECCFEB0F301FFCE15A08C65C0735ED3264AF22FBCB8B8C045035
    SPKI SHA256: 66AE4923887B8C269B1B897E697EF0D109B1C6092C07EBA351A072C30C6E9A9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BA Glauchau CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Glauchau, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, commonName=BA Glauchau CA - G01, emailAddress=admins@ba-glauchau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15DFAFE68EC772
- SHA-256: F47B632EB5B3278976FD041A076243475247FDDD21018DC4DB9506452A866047
- SPKI SHA-256: 549C90CC111852C2B9C2D9C6E4079677EFD8A4090B4CB889BC2D055E494C99B1
- Validity: 2013-06-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6156921091311474 (0x15dfafe68ec772)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 18 10:11:34 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Glauchau, O = Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, CN = BA Glauchau CA - G01, emailAddress = admins@ba-glauchau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:0F:17:AF:0E:84:20:ED:DC:BE:3E:79:9D:A6:ED:BC:A6:7E:0C:AC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admins@ba-glauchau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F47B632EB5B3278976FD041A076243475247FDDD21018DC4DB9506452A866047
    SPKI SHA256: 549C90CC111852C2B9C2D9C6E4079677EFD8A4090B4CB889BC2D055E494C99B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BA Glauchau CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Glauchau, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, commonName=BA Glauchau CA - G01, emailAddress=admins@ba-glauchau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71968FE51
- SHA-256: 184E4B84B87602597EB5AA4E97E3A96F164963A2C5DC3A004F4BCC5DBD4E231E
- SPKI SHA-256: 549C90CC111852C2B9C2D9C6E4079677EFD8A4090B4CB889BC2D055E494C99B1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400282439249 (0x17aff71968fe51)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:05 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Glauchau, O = Berufsakademie Sachsen - Staatliche Studienakademie Glauchau, CN = BA Glauchau CA - G01, emailAddress = admins@ba-glauchau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:0F:17:AF:0E:84:20:ED:DC:BE:3E:79:9D:A6:ED:BC:A6:7E:0C:AC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admins@ba-glauchau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 184E4B84B87602597EB5AA4E97E3A96F164963A2C5DC3A004F4BCC5DBD4E231E
    SPKI SHA256: 549C90CC111852C2B9C2D9C6E4079677EFD8A4090B4CB889BC2D055E494C99B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BA Sachsen - Staatliche Studienakademie Dresden CA - G01

- Subject: countryName=DE, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Dresden, organizationalUnitName=Rechenzentrum, commonName=BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress=rechenzentrum@ba-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF70E29B8E8
- SHA-256: 33A685B78B714FA2A2C7CEE92388861A8F24FA385DF12538C0C5ACAE318A7FBB
- SPKI SHA-256: DBD4DB69CE4877860F1555286FF45FD5E988654A59CC9EEBC2602D8623CE6207
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400093743336 (0x17aff70e29b8e8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Berufsakademie Sachsen - Staatliche Studienakademie Dresden, OU = Rechenzentrum, CN = BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress = rechenzentrum@ba-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C1:26:F7:BF:DF:A1:10:60:83:76:1E:3B:1B:AD:10:CD:3F:80:7C:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rechenzentrum@ba-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 33A685B78B714FA2A2C7CEE92388861A8F24FA385DF12538C0C5ACAE318A7FBB
    SPKI SHA256: DBD4DB69CE4877860F1555286FF45FD5E988654A59CC9EEBC2602D8623CE6207
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BA Sachsen - Staatliche Studienakademie Dresden CA - G01

- Subject: countryName=DE, organizationName=Berufsakademie Sachsen - Staatliche Studienakademie Dresden, organizationalUnitName=Rechenzentrum, commonName=BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress=rechenzentrum@ba-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14DC2F29C82307
- SHA-256: F0DDC3ECD67E6F7850BE3A7652D4F248616F60B735A2786235428DDF0CB1987F
- SPKI SHA-256: DBD4DB69CE4877860F1555286FF45FD5E988654A59CC9EEBC2602D8623CE6207
- Validity: 2012-12-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5871594656768775 (0x14dc2f29c82307)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  3 14:05:14 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Berufsakademie Sachsen - Staatliche Studienakademie Dresden, OU = Rechenzentrum, CN = BA Sachsen - Staatliche Studienakademie Dresden CA - G01, emailAddress = rechenzentrum@ba-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C1:26:F7:BF:DF:A1:10:60:83:76:1E:3B:1B:AD:10:CD:3F:80:7C:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rechenzentrum@ba-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F0DDC3ECD67E6F7850BE3A7652D4F248616F60B735A2786235428DDF0CB1987F
    SPKI SHA256: DBD4DB69CE4877860F1555286FF45FD5E988654A59CC9EEBC2602D8623CE6207
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BA Sachsen Staatliche Studienakademie Bautzen CA

- Subject: countryName=DE, organizationName=Berufsakademie Sachsen Staatliche Studienakademie Bautzen, commonName=BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress=ca@ba-bautzen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FB5F6D9
- SHA-256: DB87262C5FD34CF714217D2062BF4525F38B77CB658E1A813CA7288E7ABAA3E3
- SPKI SHA-256: 44DACE80DD0F24E2DD50A57D0927C44E0158AE3286885045498365414D94DE3F
- Validity: 2010-03-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 263583449 (0xfb5f6d9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  9 16:37:30 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Berufsakademie Sachsen Staatliche Studienakademie Bautzen, CN = BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress = ca@ba-bautzen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                58:CE:9E:05:3C:18:E6:83:AD:86:1B:9C:2E:F0:0A:6F:A5:57:CA:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ba-bautzen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DB87262C5FD34CF714217D2062BF4525F38B77CB658E1A813CA7288E7ABAA3E3
    SPKI SHA256: 44DACE80DD0F24E2DD50A57D0927C44E0158AE3286885045498365414D94DE3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BA Sachsen Staatliche Studienakademie Bautzen CA

- Subject: countryName=DE, organizationName=Berufsakademie Sachsen Staatliche Studienakademie Bautzen, commonName=BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress=ca@ba-bautzen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D2BDA661
- SHA-256: 1570DF97751F72A78E878A46A6423DA9ED07C051C0AC21B44B3AB04923B97C50
- SPKI SHA-256: 44DACE80DD0F24E2DD50A57D0927C44E0158AE3286885045498365414D94DE3F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399096804961 (0x17aff6d2bda661)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Berufsakademie Sachsen Staatliche Studienakademie Bautzen, CN = BA Sachsen Staatliche Studienakademie Bautzen CA, emailAddress = ca@ba-bautzen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                58:CE:9E:05:3C:18:E6:83:AD:86:1B:9C:2E:F0:0A:6F:A5:57:CA:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ba-bautzen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1570DF97751F72A78E878A46A6423DA9ED07C051C0AC21B44B3AB04923B97C50
    SPKI SHA256: 44DACE80DD0F24E2DD50A57D0927C44E0158AE3286885045498365414D94DE3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BAST CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bergisch Gladbach, organizationName=Bundesanstalt fuer Strassenwesen, commonName=BAST CA - G01, emailAddress=ca@bast.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1930BACEDD9756
- SHA-256: A91757C5D5BD56B08A445BAA0F0B274E9EA3C6CBFA21751BF60E26AF560E6149
- SPKI SHA-256: 5026E35762C5B99808E2816E80A19977939A54DDBE35A2AE90EC1D37B6AF9E4C
- Validity: 2015-03-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7090453310445398 (0x1930bacedd9756)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 24 10:32:30 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bergisch Gladbach, O = Bundesanstalt fuer Strassenwesen, CN = BAST CA - G01, emailAddress = ca@bast.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                51:78:52:2F:85:7C:13:C4:0C:57:99:D1:1C:8E:F3:A7:D8:B3:B7:59
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bast.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A91757C5D5BD56B08A445BAA0F0B274E9EA3C6CBFA21751BF60E26AF560E6149
    SPKI SHA256: 5026E35762C5B99808E2816E80A19977939A54DDBE35A2AE90EC1D37B6AF9E4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BAW CA

- Subject: countryName=DE, organizationName=Bundesanstalt fuer Wasserbau, commonName=BAW CA, emailAddress=baw-ca@baw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42470D86966
- SHA-256: 329783D589C22982615059218F1DC14CD9E9EE28448B7EDD90560E9352D1857B
- SPKI SHA-256: DFFAFAA581D9997FCF59E85F45FE7495E39DA87C5BA08BE204425A0D46E011F7
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400883353958 (0x17a42470d86966)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:21 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt fuer Wasserbau, CN = BAW CA, emailAddress = baw-ca@baw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                06:23:10:BD:8A:02:85:AB:62:AC:AA:87:55:24:D7:DC:C9:92:17:E2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:baw-ca@baw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 329783D589C22982615059218F1DC14CD9E9EE28448B7EDD90560E9352D1857B
    SPKI SHA256: DFFAFAA581D9997FCF59E85F45FE7495E39DA87C5BA08BE204425A0D46E011F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BAW CA

- Subject: countryName=DE, organizationName=Bundesanstalt fuer Wasserbau, commonName=BAW CA, emailAddress=baw-ca@baw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A727058
- SHA-256: 53D838A18142FEEA1D9974622FE294E225FE461D7F0328D69FDEBA28E4AFCC01
- SPKI SHA-256: DFFAFAA581D9997FCF59E85F45FE7495E39DA87C5BA08BE204425A0D46E011F7
- Validity: 2007-05-22 to 2019-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175272024 (0xa727058)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 22 13:40:26 2007 GMT
            Not After : May 21 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt fuer Wasserbau, CN = BAW CA, emailAddress = baw-ca@baw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                06:23:10:BD:8A:02:85:AB:62:AC:AA:87:55:24:D7:DC:C9:92:17:E2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:baw-ca@baw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 53D838A18142FEEA1D9974622FE294E225FE461D7F0328D69FDEBA28E4AFCC01
    SPKI SHA256: DFFAFAA581D9997FCF59E85F45FE7495E39DA87C5BA08BE204425A0D46E011F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BBAW-CA 1

- Subject: countryName=DE, organizationName=Berlin-Brandenburgische Akademie der Wissenschaften, organizationalUnitName=Informationstechnologie, commonName=BBAW-CA 1, emailAddress=ca@bbaw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0EE57D61
- SHA-256: 6DA9C1FECA9008B378D2B6EF53A41096CD1448F1D7A0B85AFCAAF364B7561976
- SPKI SHA-256: 4D03E273BD28B07A61CE2F8CF405F124921B54867ADC424168E588D0160A2A65
- Validity: 2009-10-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 249920865 (0xee57d61)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  2 13:27:45 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Berlin-Brandenburgische Akademie der Wissenschaften, OU = Informationstechnologie, CN = BBAW-CA 1, emailAddress = ca@bbaw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:A6:8F:F1:3F:14:3B:02:B5:F9:27:54:4C:AB:3C:A1:D8:1B:90:98
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bbaw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6DA9C1FECA9008B378D2B6EF53A41096CD1448F1D7A0B85AFCAAF364B7561976
    SPKI SHA256: 4D03E273BD28B07A61CE2F8CF405F124921B54867ADC424168E588D0160A2A65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BBAW-CA 1

- Subject: countryName=DE, organizationName=Berlin-Brandenburgische Akademie der Wissenschaften, organizationalUnitName=Informationstechnologie, commonName=BBAW-CA 1, emailAddress=ca@bbaw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6BE61A8F4
- SHA-256: 5214F6FAA90E4B54C5A35227B121DAD654CB2F83E36C1DE87CDDAE96D84AFB13
- SPKI SHA-256: 4D03E273BD28B07A61CE2F8CF405F124921B54867ADC424168E588D0160A2A65
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398755231988 (0x17aff6be61a8f4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Berlin-Brandenburgische Akademie der Wissenschaften, OU = Informationstechnologie, CN = BBAW-CA 1, emailAddress = ca@bbaw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:A6:8F:F1:3F:14:3B:02:B5:F9:27:54:4C:AB:3C:A1:D8:1B:90:98
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bbaw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5214F6FAA90E4B54C5A35227B121DAD654CB2F83E36C1DE87CDDAE96D84AFB13
    SPKI SHA256: 4D03E273BD28B07A61CE2F8CF405F124921B54867ADC424168E588D0160A2A65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BESSY CA - G02

- Subject: countryName=DE, organizationName=BESSY, organizationalUnitName=EDV, commonName=BESSY CA - G02, emailAddress=PKI@bessy.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A83A1CD
- SHA-256: 40D7BE59E3ED2C39A0CAFBEC5BD9496256454A174DE1AD6D2DBFD0202894227C
- SPKI SHA-256: 1D023D7CAE7EDB5FDA5771205E1192C0702C62A8DC050E7D326BAFFA5AAFB32F
- Validity: 2007-06-04 to 2019-06-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 176398797 (0xa83a1cd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  4 14:39:58 2007 GMT
            Not After : Jun  3 00:00:00 2019 GMT
        Subject: C = DE, O = BESSY, OU = EDV, CN = BESSY CA - G02, emailAddress = PKI@bessy.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8E:9F:7B:DD:B7:6D:D0:48:61:B4:B3:80:D7:90:83:5B:B3:4A:06:AA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:PKI@bessy.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 40D7BE59E3ED2C39A0CAFBEC5BD9496256454A174DE1AD6D2DBFD0202894227C
    SPKI SHA256: 1D023D7CAE7EDB5FDA5771205E1192C0702C62A8DC050E7D326BAFFA5AAFB32F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Beuth Hochschule Berlin CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Beuth Hochschule fuer Technik Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=Beuth Hochschule Berlin CA, emailAddress=pki@beuth-hochschule.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6BB13AD8C
- SHA-256: 8741D4C63658EAF66149FFA8E11C4B979E0FB8B0F7683D015F037FFC87A61E77
- SPKI SHA-256: B1F4B84AAA1D1CE5D1CF99941EEFA49A5A7AB7FD36034F6F0530F330EA6B9527
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398699789708 (0x17aff6bb13ad8c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:31 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Beuth Hochschule fuer Technik Berlin, OU = Hochschulrechenzentrum, CN = Beuth Hochschule Berlin CA, emailAddress = pki@beuth-hochschule.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D4:2E:F6:9B:10:AE:EC:09:B2:5D:69:E9:26:87:E4:B0:98:FE:44:6A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@beuth-hochschule.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8741D4C63658EAF66149FFA8E11C4B979E0FB8B0F7683D015F037FFC87A61E77
    SPKI SHA256: B1F4B84AAA1D1CE5D1CF99941EEFA49A5A7AB7FD36034F6F0530F330EA6B9527
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Beuth Hochschule Berlin CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Beuth Hochschule fuer Technik Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=Beuth Hochschule Berlin CA, emailAddress=pki@beuth-hochschule.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ED2B708
- SHA-256: 6F023B0991352E7E2B66272B287C7C88944B5F8282CBB075D72D24D63A98EC58
- SPKI SHA-256: B1F4B84AAA1D1CE5D1CF99941EEFA49A5A7AB7FD36034F6F0530F330EA6B9527
- Validity: 2009-09-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 248690440 (0xed2b708)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 18 07:40:40 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Beuth Hochschule fuer Technik Berlin, OU = Hochschulrechenzentrum, CN = Beuth Hochschule Berlin CA, emailAddress = pki@beuth-hochschule.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D4:2E:F6:9B:10:AE:EC:09:B2:5D:69:E9:26:87:E4:B0:98:FE:44:6A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@beuth-hochschule.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6F023B0991352E7E2B66272B287C7C88944B5F8282CBB075D72D24D63A98EC58
    SPKI SHA256: B1F4B84AAA1D1CE5D1CF99941EEFA49A5A7AB7FD36034F6F0530F330EA6B9527
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BfR CA

- Subject: countryName=DE, organizationName=Bundesinstitut fuer Risikobewertung, commonName=BfR CA, emailAddress=ca@bfr.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AE3E272
- SHA-256: F4A33C52ABB9E38680DEE9F4D3B6937B4D89D470DE9B0018E0E5D8A7D5E4E7B1
- SPKI SHA-256: BE0664062343F68BF79E7757DAF005AAF936758D880C945A7D48BC805A1B8B53
- Validity: 2007-08-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 182706802 (0xae3e272)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 16 14:53:24 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesinstitut fuer Risikobewertung, CN = BfR CA, emailAddress = ca@bfr.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:BD:F8:18:6C:0F:D5:0B:40:23:D5:7D:DC:76:52:27:55:A6:B1:01
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bfr.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F4A33C52ABB9E38680DEE9F4D3B6937B4D89D470DE9B0018E0E5D8A7D5E4E7B1
    SPKI SHA256: BE0664062343F68BF79E7757DAF005AAF936758D880C945A7D48BC805A1B8B53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BfR CA

- Subject: countryName=DE, organizationName=Bundesinstitut fuer Risikobewertung, commonName=BfR CA, emailAddress=ca@bfr.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248DE3AF71
- SHA-256: 394646F4D21B3D795F473B84F53547277A855785DBB3B3CE6D89AEF3D3E3EA35
- SPKI SHA-256: BE0664062343F68BF79E7757DAF005AAF936758D880C945A7D48BC805A1B8B53
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401370632049 (0x17a4248de3af71)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:49 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesinstitut fuer Risikobewertung, CN = BfR CA, emailAddress = ca@bfr.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                16:BD:F8:18:6C:0F:D5:0B:40:23:D5:7D:DC:76:52:27:55:A6:B1:01
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bfr.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 394646F4D21B3D795F473B84F53547277A855785DBB3B3CE6D89AEF3D3E3EA35
    SPKI SHA256: BE0664062343F68BF79E7757DAF005AAF936758D880C945A7D48BC805A1B8B53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### bgr-ca

- Subject: countryName=DE, organizationName=Bundesanstalt f. Geowissenschaften u. Rohstoffe, organizationalUnitName=Zentrale Informationstechnik, commonName=bgr-ca
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4256610A381
- SHA-256: 3B3508F4C697455350C3861DB263EFED2359AEC57812B1EC0B93B60053341A99
- SPKI SHA-256: 31F7B8850BFEFAC45AEC024D149841050429450ABBEAFBE713AA73D5FD7DDADF
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404997456769 (0x17a4256610a381)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt f. Geowissenschaften u. Rohstoffe, OU = Zentrale Informationstechnik, CN = bgr-ca
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                88:5F:E1:28:C4:3F:3A:CB:1A:E4:D6:F4:83:E2:88:B5:43:E2:F8:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B3508F4C697455350C3861DB263EFED2359AEC57812B1EC0B93B60053341A99
    SPKI SHA256: 31F7B8850BFEFAC45AEC024D149841050429450ABBEAFBE713AA73D5FD7DDADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### bgr-ca

- Subject: countryName=DE, organizationName=Bundesanstalt f. Geowissenschaften u. Rohstoffe, organizationalUnitName=Zentrale Informationstechnik, commonName=bgr-ca
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0376FA
- SHA-256: B4EA2A81D8C8DEAB5511A617DF5639D35A9694A4DEAD8CB3C2B00F1E0519E14E
- SPKI SHA-256: 31F7B8850BFEFAC45AEC024D149841050429450ABBEAFBE713AA73D5FD7DDADF
- Validity: 2007-02-27 to 2019-02-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167999226 (0xa0376fa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 27 09:27:07 2007 GMT
            Not After : Feb 26 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt f. Geowissenschaften u. Rohstoffe, OU = Zentrale Informationstechnik, CN = bgr-ca
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                88:5F:E1:28:C4:3F:3A:CB:1A:E4:D6:F4:83:E2:88:B5:43:E2:F8:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B4EA2A81D8C8DEAB5511A617DF5639D35A9694A4DEAD8CB3C2B00F1E0519E14E
    SPKI SHA256: 31F7B8850BFEFAC45AEC024D149841050429450ABBEAFBE713AA73D5FD7DDADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bischoeflich Muenstersches Offizialat CA - G01

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Bischoeflich Muenstersches Offizialat, organizationalUnitName=IT, commonName=Bischoeflich Muenstersches Offizialat CA - G01, emailAddress=ca@bmo-vechta.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12AA7BBABC15F9
- SHA-256: 02FEA5A2184A2B7E71BF482A3688A1D9FB95342921992E9FCD68ABB00813FB98
- SPKI SHA-256: 9FE3FEDF271CA2AAC57FDE2E65422C6DFB4579F7BC75EFA55855AE4E6B3289A0
- Validity: 2011-10-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5253997971379705 (0x12aa7bbabc15f9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  4 12:38:02 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Vechta, O = Bischoeflich Muenstersches Offizialat, OU = IT, CN = Bischoeflich Muenstersches Offizialat CA - G01, emailAddress = ca@bmo-vechta.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                60:96:B8:09:06:64:A6:0E:45:B0:94:3D:F0:C9:71:97:94:62:5E:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bmo-vechta.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 02FEA5A2184A2B7E71BF482A3688A1D9FB95342921992E9FCD68ABB00813FB98
    SPKI SHA256: 9FE3FEDF271CA2AAC57FDE2E65422C6DFB4579F7BC75EFA55855AE4E6B3289A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bischoeflich Muenstersches Offizialat CA - G01

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Bischoeflich Muenstersches Offizialat, organizationalUnitName=IT, commonName=Bischoeflich Muenstersches Offizialat CA - G01, emailAddress=ca@bmo-vechta.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F7C54566
- SHA-256: 3A9E5BA4455E9A8BFC86270F07173605E39092EC4E5891B761247E30804D2A7B
- SPKI SHA-256: 9FE3FEDF271CA2AAC57FDE2E65422C6DFB4579F7BC75EFA55855AE4E6B3289A0
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399718061414 (0x17aff6f7c54566)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:32 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Vechta, O = Bischoeflich Muenstersches Offizialat, OU = IT, CN = Bischoeflich Muenstersches Offizialat CA - G01, emailAddress = ca@bmo-vechta.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                60:96:B8:09:06:64:A6:0E:45:B0:94:3D:F0:C9:71:97:94:62:5E:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bmo-vechta.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3A9E5BA4455E9A8BFC86270F07173605E39092EC4E5891B761247E30804D2A7B
    SPKI SHA256: 9FE3FEDF271CA2AAC57FDE2E65422C6DFB4579F7BC75EFA55855AE4E6B3289A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BLB Karlsruhe CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Badische Landesbibliothek, organizationalUnitName=IT-Abteilung, commonName=BLB Karlsruhe CA, emailAddress=ca@blb-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C1AEF7D
- SHA-256: 114C94295410096F79639758E1B12EA861CBB360C7C0B2E473778CCCE81BE7B1
- SPKI SHA-256: 6DFA724A5681FAED240AAF743E128C1EB457D7CC1B71B2A1A2DD28725751ECA9
- Validity: 2008-04-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 203091837 (0xc1aef7d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  8 13:23:58 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Badische Landesbibliothek, OU = IT-Abteilung, CN = BLB Karlsruhe CA, emailAddress = ca@blb-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D8:12:EE:FF:AA:82:11:09:54:27:29:69:A4:69:1B:B7:95:EA:8D:5A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@blb-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 114C94295410096F79639758E1B12EA861CBB360C7C0B2E473778CCCE81BE7B1
    SPKI SHA256: 6DFA724A5681FAED240AAF743E128C1EB457D7CC1B71B2A1A2DD28725751ECA9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BLB Karlsruhe CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Badische Landesbibliothek, organizationalUnitName=IT-Abteilung, commonName=BLB Karlsruhe CA, emailAddress=ca@blb-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B61B7630
- SHA-256: F64840407B212488768451B4B6ADCB2C474541476E6B8F6E500EF09C1EEBB226
- SPKI SHA-256: 6DFA724A5681FAED240AAF743E128C1EB457D7CC1B71B2A1A2DD28725751ECA9
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402045376048 (0x17a424b61b7630)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:30 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Badische Landesbibliothek, OU = IT-Abteilung, CN = BLB Karlsruhe CA, emailAddress = ca@blb-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D8:12:EE:FF:AA:82:11:09:54:27:29:69:A4:69:1B:B7:95:EA:8D:5A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@blb-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F64840407B212488768451B4B6ADCB2C474541476E6B8F6E500EF09C1EEBB226
    SPKI SHA256: 6DFA724A5681FAED240AAF743E128C1EB457D7CC1B71B2A1A2DD28725751ECA9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BMMV CA - G 01

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Schwerin, organizationName=Ministerium fuer Bildung, Wissenschaft und Kultur M-V, organizationalUnitName=BMMV-PKI, commonName=BMMV CA - G 01, emailAddress=ca@kultus-mv.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE368AA
- SHA-256: 6D0B9118C39951A82C93C62C62B949FE2EDDD80D7756B877BF1280174AABC586
- SPKI SHA-256: B32312B0581BBBDFEA18D8CC32526697DA8F3F0DCA47B20F923D0522D1BC8CAE
- Validity: 2008-02-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199452842 (0xbe368aa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 10:34:03 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Schwerin, O = "Ministerium fuer Bildung, Wissenschaft und Kultur M-V", OU = BMMV-PKI, CN = BMMV CA - G 01, emailAddress = ca@kultus-mv.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8B:F3:1B:DD:24:F9:AE:EB:9B:17:19:7C:AD:7B:C5:A4:E1:20:F8:27
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@kultus-mv.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6D0B9118C39951A82C93C62C62B949FE2EDDD80D7756B877BF1280174AABC586
    SPKI SHA256: B32312B0581BBBDFEA18D8CC32526697DA8F3F0DCA47B20F923D0522D1BC8CAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BMMV CA - G 01

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Schwerin, organizationName=Ministerium fuer Bildung, Wissenschaft und Kultur M-V, organizationalUnitName=BMMV-PKI, commonName=BMMV CA - G 01, emailAddress=ca@kultus-mv.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424AB5CBAAD
- SHA-256: 52B7CCB4AD720BB58502C37B52277AF43597A3C57CC327286277811BF5E5C1E3
- SPKI SHA-256: B32312B0581BBBDFEA18D8CC32526697DA8F3F0DCA47B20F923D0522D1BC8CAE
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401865104045 (0x17a424ab5cbaad)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:19 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Schwerin, O = "Ministerium fuer Bildung, Wissenschaft und Kultur M-V", OU = BMMV-PKI, CN = BMMV CA - G 01, emailAddress = ca@kultus-mv.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8B:F3:1B:DD:24:F9:AE:EB:9B:17:19:7C:AD:7B:C5:A4:E1:20:F8:27
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@kultus-mv.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52B7CCB4AD720BB58502C37B52277AF43597A3C57CC327286277811BF5E5C1E3
    SPKI SHA256: B32312B0581BBBDFEA18D8CC32526697DA8F3F0DCA47B20F923D0522D1BC8CAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BSB-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bayerische Staatsbibliothek, commonName=BSB-CA, emailAddress=pki@bsb-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A425556A1F58
- SHA-256: 483F28E919E1EE6B865E7400C0562E06D51760CD5742F42681E5729846315A09
- SPKI SHA-256: D161EC65E64EA94A13F65EE2699608B21921ED651D5B04C31AFD12CC32A09920
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404718108504 (0x17a425556a1f58)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Bayerische Staatsbibliothek, OU = Bayerische Staatsbibliothek, CN = BSB-CA, emailAddress = pki@bsb-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7A:67:8C:5B:1A:13:44:82:B3:21:5A:1B:2A:8A:F3:9F:31:E0:C4:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bsb-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 483F28E919E1EE6B865E7400C0562E06D51760CD5742F42681E5729846315A09
    SPKI SHA256: D161EC65E64EA94A13F65EE2699608B21921ED651D5B04C31AFD12CC32A09920
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BSB-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bayerische Staatsbibliothek, commonName=BSB-CA, emailAddress=pki@bsb-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A73CA6A
- SHA-256: B8CD6A1E4EA4A6F873806BA28ACC2EA4341CE58B3F760DE5C904552D3EC25ABF
- SPKI SHA-256: D161EC65E64EA94A13F65EE2699608B21921ED651D5B04C31AFD12CC32A09920
- Validity: 2007-05-23 to 2019-05-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175360618 (0xa73ca6a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 23 14:17:00 2007 GMT
            Not After : May 22 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Bayerische Staatsbibliothek, OU = Bayerische Staatsbibliothek, CN = BSB-CA, emailAddress = pki@bsb-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7A:67:8C:5B:1A:13:44:82:B3:21:5A:1B:2A:8A:F3:9F:31:E0:C4:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bsb-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B8CD6A1E4EA4A6F873806BA28ACC2EA4341CE58B3F760DE5C904552D3EC25ABF
    SPKI SHA256: D161EC65E64EA94A13F65EE2699608B21921ED651D5B04C31AFD12CC32A09920
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BSH-CA

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Bundesamt fuer Seeschifffahrt und Hydrographie, organizationalUnitName=IT-Entwicklung Netze, commonName=BSH-CA, emailAddress=it-netzwerk@bsh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7383C24B2
- SHA-256: D8861099B4E64518BD499D4A6F7A052BC6FCEF8D902DF24928A4475ECFDF9514
- SPKI SHA-256: DF1F22034B4591B0AE45E51A3CA3B71950136E2481862E137F8DD3B28838F498
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400799593650 (0x17aff7383c24b2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Bundesamt fuer Seeschifffahrt und Hydrographie, OU = IT-Entwicklung Netze, CN = BSH-CA, emailAddress = it-netzwerk@bsh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1B:33:BE:8E:A7:27:FD:91:B4:CC:AA:6D:16:20:85:60:6A:42:2F:66
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:it-netzwerk@bsh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8861099B4E64518BD499D4A6F7A052BC6FCEF8D902DF24928A4475ECFDF9514
    SPKI SHA256: DF1F22034B4591B0AE45E51A3CA3B71950136E2481862E137F8DD3B28838F498
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BSH-CA

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Bundesamt fuer Seeschifffahrt und Hydrographie, organizationalUnitName=IT-Entwicklung Netze, commonName=BSH-CA, emailAddress=it-netzwerk@bsh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12917321F614D9
- SHA-256: DF9FAF3A06B641813E57FA776B1369F3561FAB671C6E815CB3C99D50624205C3
- SPKI SHA-256: DF1F22034B4591B0AE45E51A3CA3B71950136E2481862E137F8DD3B28838F498
- Validity: 2011-09-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5226473257833689 (0x12917321f614d9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 15 12:54:42 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Bundesamt fuer Seeschifffahrt und Hydrographie, OU = IT-Entwicklung Netze, CN = BSH-CA, emailAddress = it-netzwerk@bsh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1B:33:BE:8E:A7:27:FD:91:B4:CC:AA:6D:16:20:85:60:6A:42:2F:66
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:it-netzwerk@bsh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DF9FAF3A06B641813E57FA776B1369F3561FAB671C6E815CB3C99D50624205C3
    SPKI SHA256: DF1F22034B4591B0AE45E51A3CA3B71950136E2481862E137F8DD3B28838F498
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BSZ-BW CA - G02

- Subject: countryName=DE, organizationName=Bibliotheksservice-Zentrum Baden-Wuerttemberg, commonName=BSZ-BW CA - G02, emailAddress=pki@bsz-bw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB1A9
- SHA-256: 62DB37D846CF13D564179EBD5888BC4B45692B043C8E0D7E4EE7720A680396FD
- SPKI SHA-256: 661DA0C789DF1D816DE5538248C0E20F2605924F7AC2973F458C87CEDE6280EA
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604073 (0xa0cb1a9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:54 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Bibliotheksservice-Zentrum Baden-Wuerttemberg, CN = BSZ-BW CA - G02, emailAddress = pki@bsz-bw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                29:AD:00:DE:CB:66:E5:1F:DE:AA:8D:6D:EC:9C:B4:42:FE:FB:9B:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bsz-bw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 62DB37D846CF13D564179EBD5888BC4B45692B043C8E0D7E4EE7720A680396FD
    SPKI SHA256: 661DA0C789DF1D816DE5538248C0E20F2605924F7AC2973F458C87CEDE6280EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BSZ-BW CA - G02

- Subject: countryName=DE, organizationName=Bibliotheksservice-Zentrum Baden-Wuerttemberg, commonName=BSZ-BW CA - G02, emailAddress=pki@bsz-bw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F2BFD7AC
- SHA-256: 792B227BA5BC4980057D9C3777D2874D84C080BD3A15B9276328EBB9159B4D52
- SPKI SHA-256: 661DA0C789DF1D816DE5538248C0E20F2605924F7AC2973F458C87CEDE6280EA
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670528264108 (0x179060f2bfd7ac)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:10 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bibliotheksservice-Zentrum Baden-Wuerttemberg, CN = BSZ-BW CA - G02, emailAddress = pki@bsz-bw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                29:AD:00:DE:CB:66:E5:1F:DE:AA:8D:6D:EC:9C:B4:42:FE:FB:9B:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bsz-bw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 792B227BA5BC4980057D9C3777D2874D84C080BD3A15B9276328EBB9159B4D52
    SPKI SHA256: 661DA0C789DF1D816DE5538248C0E20F2605924F7AC2973F458C87CEDE6280EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BTU-CA (G01 2008)

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Cottbus, organizationName=Brandenburgische Technische Universitaet Cottbus, organizationalUnitName=Rechenzentrum, commonName=BTU-CA (G01 2008), emailAddress=ca-btu@tu-cottbus.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B89EFAD
- SHA-256: 45573F6C212F472C9E5B41900B179EA812D704C3B0C684E61A018F322A9889D9
- SPKI SHA-256: ADF4383C5F4062E5C33E7CD5885239664AE17602C90D44E3C9145D229F102E5F
- Validity: 2007-12-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193589165 (0xb89efad)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 20 13:46:06 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Cottbus, O = Brandenburgische Technische Universitaet Cottbus, OU = Rechenzentrum, CN = BTU-CA (G01 2008), emailAddress = ca-btu@tu-cottbus.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                58:1D:B2:6A:AD:92:31:73:A5:DB:39:39:52:67:1A:44:06:DA:3E:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-btu@tu-cottbus.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 45573F6C212F472C9E5B41900B179EA812D704C3B0C684E61A018F322A9889D9
    SPKI SHA256: ADF4383C5F4062E5C33E7CD5885239664AE17602C90D44E3C9145D229F102E5F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BTU-CA (G01 2008)

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Cottbus, organizationName=Brandenburgische Technische Universitaet Cottbus, organizationalUnitName=Rechenzentrum, commonName=BTU-CA (G01 2008), emailAddress=ca-btu@tu-cottbus.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249D367D2D
- SHA-256: D399B31F51389FEDDD5F7F702E86E5349444EF63AFE4534A4D177C8C4FFB1320
- SPKI SHA-256: ADF4383C5F4062E5C33E7CD5885239664AE17602C90D44E3C9145D229F102E5F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401627716909 (0x17a4249d367d2d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Cottbus, O = Brandenburgische Technische Universitaet Cottbus, OU = Rechenzentrum, CN = BTU-CA (G01 2008), emailAddress = ca-btu@tu-cottbus.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                58:1D:B2:6A:AD:92:31:73:A5:DB:39:39:52:67:1A:44:06:DA:3E:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-btu@tu-cottbus.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D399B31F51389FEDDD5F7F702E86E5349444EF63AFE4534A4D177C8C4FFB1320
    SPKI SHA256: ADF4383C5F4062E5C33E7CD5885239664AE17602C90D44E3C9145D229F102E5F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BU Weimar CA - G02

- Subject: countryName=DE, organizationName=Bauhaus-Universitaet Weimar, organizationalUnitName=SCC, commonName=BU Weimar CA - G02, emailAddress=pki@uni-weimar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060EA202E95
- SHA-256: 4653F67C45B151F534FBAD7E2B8589C03B81EB6C1A337B2C7A437C2076A7365E
- SPKI SHA-256: EECE576544CD707D6F6A0FB51EF79B023AF4ABFC1AE6636003F231AE6389EB4A
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670383582869 (0x179060ea202e95)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bauhaus-Universitaet Weimar, OU = SCC, CN = BU Weimar CA - G02, emailAddress = pki@uni-weimar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E7:F2:D0:3B:25:BB:5D:23:C8:03:4A:9D:AB:2C:35:4C:E4:F7:E4:3E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-weimar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4653F67C45B151F534FBAD7E2B8589C03B81EB6C1A337B2C7A437C2076A7365E
    SPKI SHA256: EECE576544CD707D6F6A0FB51EF79B023AF4ABFC1AE6636003F231AE6389EB4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BU Weimar CA - G02

- Subject: countryName=DE, organizationName=Bauhaus-Universitaet Weimar, organizationalUnitName=SCC, commonName=BU Weimar CA - G02, emailAddress=pki@uni-weimar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A022360
- SHA-256: DDE266FE68AF3B8077341EB068A89091327E5D38E9D0705223F775DA91272B84
- SPKI SHA-256: EECE576544CD707D6F6A0FB51EF79B023AF4ABFC1AE6636003F231AE6389EB4A
- Validity: 2007-02-26 to 2019-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167912288 (0xa022360)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 09:18:10 2007 GMT
            Not After : Feb 25 00:00:00 2019 GMT
        Subject: C = DE, O = Bauhaus-Universitaet Weimar, OU = SCC, CN = BU Weimar CA - G02, emailAddress = pki@uni-weimar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E7:F2:D0:3B:25:BB:5D:23:C8:03:4A:9D:AB:2C:35:4C:E4:F7:E4:3E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-weimar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DDE266FE68AF3B8077341EB068A89091327E5D38E9D0705223F775DA91272B84
    SPKI SHA256: EECE576544CD707D6F6A0FB51EF79B023AF4ABFC1AE6636003F231AE6389EB4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bundesamt fuer Kartographie und Geodaesie CA

- Subject: countryName=DE, organizationName=Bundesamt fuer Kartographie und Geodaesie, commonName=Bundesamt fuer Kartographie und Geodaesie CA, emailAddress=pki@bkg.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A6F58C5F
- SHA-256: 5DD43BD6593F2A4743EC5C528288BF1B17BB3843A092D45EFF8E75AAC6D0706E
- SPKI SHA-256: 1C0595DDB9A9CCB665335763874D10422C23C51055F6BE2D5E9AD1AAB27DD481
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401791233119 (0x17a424a6f58c5f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:15 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesamt fuer Kartographie und Geodaesie, CN = Bundesamt fuer Kartographie und Geodaesie CA, emailAddress = pki@bkg.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:FC:B2:DE:25:11:81:85:E2:E5:53:81:0D:CF:A2:47:B2:A5:B7:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bkg.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5DD43BD6593F2A4743EC5C528288BF1B17BB3843A092D45EFF8E75AAC6D0706E
    SPKI SHA256: 1C0595DDB9A9CCB665335763874D10422C23C51055F6BE2D5E9AD1AAB27DD481
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Bundesamt fuer Kartographie und Geodaesie CA

- Subject: countryName=DE, organizationName=Bundesamt fuer Kartographie und Geodaesie, commonName=Bundesamt fuer Kartographie und Geodaesie CA, emailAddress=pki@bkg.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BCA51BC
- SHA-256: 1789BB96855A4243D685C56EC7DDF7BD889541E30BD59149F119E053899D8087
- SPKI SHA-256: 1C0595DDB9A9CCB665335763874D10422C23C51055F6BE2D5E9AD1AAB27DD481
- Validity: 2008-02-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 197808572 (0xbca51bc)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  7 09:49:34 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesamt fuer Kartographie und Geodaesie, CN = Bundesamt fuer Kartographie und Geodaesie CA, emailAddress = pki@bkg.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:FC:B2:DE:25:11:81:85:E2:E5:53:81:0D:CF:A2:47:B2:A5:B7:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bkg.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1789BB96855A4243D685C56EC7DDF7BD889541E30BD59149F119E053899D8087
    SPKI SHA256: 1C0595DDB9A9CCB665335763874D10422C23C51055F6BE2D5E9AD1AAB27DD481
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bundesamt fuer Strahlenschutz CA

- Subject: countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C9E0F00D
- SHA-256: C14BB15C08E3F4A0A4F1B234C41A1E13F69D41A724954BC04EBC1236ED066BDD
- SPKI SHA-256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398948122637 (0x17aff6c9e0f00d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:46 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesamt fuer Strahlenschutz, CN = Bundesamt fuer Strahlenschutz CA, emailAddress = bfs-pki@bfs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                08:EF:74:D5:85:18:27:3F:8A:21:6D:8B:64:C6:84:ED:D6:46:1B:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:bfs-pki@bfs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C14BB15C08E3F4A0A4F1B234C41A1E13F69D41A724954BC04EBC1236ED066BDD
    SPKI SHA256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Bundesamt fuer Strahlenschutz CA

- Subject: countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F6A699A
- SHA-256: 2D104218FB8B5B8D745293B870BEB34885DE1185A6591384E6FAAE8087B07E5B
- SPKI SHA-256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
- Validity: 2010-01-11 to 2010-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 258632090 (0xf6a699a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 11 09:14:50 2010 GMT
            Not After : Jun 30 00:00:00 2010 GMT
        Subject: C = DE, O = Bundesamt fuer Strahlenschutz, CN = Bundesamt fuer Strahlenschutz CA, emailAddress = bfs-pki@bfs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                08:EF:74:D5:85:18:27:3F:8A:21:6D:8B:64:C6:84:ED:D6:46:1B:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:bfs-pki@bfs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2D104218FB8B5B8D745293B870BEB34885DE1185A6591384E6FAAE8087B07E5B
    SPKI SHA256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bundesamt fuer Strahlenschutz CA

- Subject: countryName=DE, organizationName=Bundesamt fuer Strahlenschutz, commonName=Bundesamt fuer Strahlenschutz CA, emailAddress=bfs-pki@bfs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F6D5819
- SHA-256: 5C1876ACE199BD36AEF7F455E9F0559BDB7E3874A2E85B243EE6543E444B4900
- SPKI SHA-256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
- Validity: 2010-01-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 258824217 (0xf6d5819)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 13 14:36:57 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesamt fuer Strahlenschutz, CN = Bundesamt fuer Strahlenschutz CA, emailAddress = bfs-pki@bfs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                08:EF:74:D5:85:18:27:3F:8A:21:6D:8B:64:C6:84:ED:D6:46:1B:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:bfs-pki@bfs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5C1876ACE199BD36AEF7F455E9F0559BDB7E3874A2E85B243EE6543E444B4900
    SPKI SHA256: 878175A35AEDF006D872692B549F7E80445B247AD1C5D38A3CC46ABE7B128F81
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1

- Subject: countryName=DE, organizationName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), commonName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress=pki-dfn@baua.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F3DF15FE
- SHA-256: 9B2FBEE893FC263CF4103BE1FDBE523936360DD51F37592911150DAEE3A573CA
- SPKI SHA-256: A515200005265B03B59446B2DB8241D1A17256F579A6C7B6079937DA92D58D72
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399652644350 (0x17aff6f3df15fe)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:27 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), CN = Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress = pki-dfn@baua.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B9:7D:48:8D:35:7C:CD:59:42:1B:71:2A:C2:17:50:66:9F:9C:54:F2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-dfn@baua.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9B2FBEE893FC263CF4103BE1FDBE523936360DD51F37592911150DAEE3A573CA
    SPKI SHA256: A515200005265B03B59446B2DB8241D1A17256F579A6C7B6079937DA92D58D72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1

- Subject: countryName=DE, organizationName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), commonName=Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress=pki-dfn@baua.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 11CE34FF
- SHA-256: F07B472B4ECB16A1E19592F8DCE31904CC200E53D56354331EA7E10F7C2AEBB9
- SPKI SHA-256: A515200005265B03B59446B2DB8241D1A17256F579A6C7B6079937DA92D58D72
- Validity: 2011-04-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 298726655 (0x11ce34ff)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 20 10:37:35 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA), CN = Bundesanstalt fuer Arbeitsschutz und Arbeitsmedizin (BAuA) CA-G1, emailAddress = pki-dfn@baua.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B9:7D:48:8D:35:7C:CD:59:42:1B:71:2A:C2:17:50:66:9F:9C:54:F2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-dfn@baua.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F07B472B4ECB16A1E19592F8DCE31904CC200E53D56354331EA7E10F7C2AEBB9
    SPKI SHA256: A515200005265B03B59446B2DB8241D1A17256F579A6C7B6079937DA92D58D72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Bundesanstalt fuer IT-Dienstleistungen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Ilmenau, organizationName=Bundesanstalt fuer IT-Dienstleistungen, organizationalUnitName=DLZ-IT BMVBS, commonName=Bundesanstalt fuer IT-Dienstleistungen CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17887D0923D576
- SHA-256: B72D90C431137DC6A70F23DFF4B72AB5F027F0B6A059477061B197C05498486C
- SPKI SHA-256: 67408EF63EE23105A0D754392619580CE247A50CF01BF97C65E950DCA8EB6CAD
- Validity: 2014-05-06 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6623995069977974 (0x17887d0923d576)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  6 15:27:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Ilmenau, O = Bundesanstalt fuer IT-Dienstleistungen, OU = DLZ-IT BMVBS, CN = Bundesanstalt fuer IT-Dienstleistungen CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CB:F1:75:F5:23:BA:0A:5E:F3:B7:6A:E9:CB:DD:B4:66:52:2F:72:53
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B72D90C431137DC6A70F23DFF4B72AB5F027F0B6A059477061B197C05498486C
    SPKI SHA256: 67408EF63EE23105A0D754392619580CE247A50CF01BF97C65E950DCA8EB6CAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Bundesanstalt fuer IT-Dienstleistungen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Ilmenau, organizationName=Bundesanstalt fuer IT-Dienstleistungen, organizationalUnitName=DLZ-IT BMVBS, commonName=Bundesanstalt fuer IT-Dienstleistungen CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 143B3E60DFD16F
- SHA-256: 0AB6868436FAEC1C16C693958FAA320D5ED5312B46C121E9344BEA1B1F1B52AA
- SPKI SHA-256: 67408EF63EE23105A0D754392619580CE247A50CF01BF97C65E950DCA8EB6CAD
- Validity: 2012-08-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5694638633505135 (0x143b3e60dfd16f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  3 12:15:12 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Ilmenau, O = Bundesanstalt fuer IT-Dienstleistungen, OU = DLZ-IT BMVBS, CN = Bundesanstalt fuer IT-Dienstleistungen CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CB:F1:75:F5:23:BA:0A:5E:F3:B7:6A:E9:CB:DD:B4:66:52:2F:72:53
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0AB6868436FAEC1C16C693958FAA320D5ED5312B46C121E9344BEA1B1F1B52AA
    SPKI SHA256: 67408EF63EE23105A0D754392619580CE247A50CF01BF97C65E950DCA8EB6CAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BVB-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bibliotheksverbund Bayern, commonName=BVB-CA, emailAddress=pki@bib-bvb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A03775D
- SHA-256: 17697AB43094BE47B74CE34ED9EFC2D62289D3611005484C9C55B6A8C359827B
- SPKI SHA-256: 6E14174110E244BF7365A73F5BB5F4200FA20B9A4A5B209C64A76E75C8378BDC
- Validity: 2007-02-27 to 2019-02-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167999325 (0xa03775d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 27 09:28:46 2007 GMT
            Not After : Feb 26 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Bayerische Staatsbibliothek, OU = Bibliotheksverbund Bayern, CN = BVB-CA, emailAddress = pki@bib-bvb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5A:F4:14:8B:3C:13:F4:56:06:33:61:C7:B2:DC:7F:B2:FC:9B:48:86
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bib-bvb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 17697AB43094BE47B74CE34ED9EFC2D62289D3611005484C9C55B6A8C359827B
    SPKI SHA256: 6E14174110E244BF7365A73F5BB5F4200FA20B9A4A5B209C64A76E75C8378BDC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BVB-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Bayerische Staatsbibliothek, organizationalUnitName=Bibliotheksverbund Bayern, commonName=BVB-CA, emailAddress=pki@bib-bvb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42563DD73FC
- SHA-256: 28B4CFF491B8686AF442750EF3C3EA77C6B0CA2959F828201698F3A6E8B0C676
- SPKI SHA-256: 6E14174110E244BF7365A73F5BB5F4200FA20B9A4A5B209C64A76E75C8378BDC
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404960547836 (0x17a42563dd73fc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Bayerische Staatsbibliothek, OU = Bibliotheksverbund Bayern, CN = BVB-CA, emailAddress = pki@bib-bvb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5A:F4:14:8B:3C:13:F4:56:06:33:61:C7:B2:DC:7F:B2:FC:9B:48:86
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bib-bvb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 28B4CFF491B8686AF442750EF3C3EA77C6B0CA2959F828201698F3A6E8B0C676
    SPKI SHA256: 6E14174110E244BF7365A73F5BB5F4200FA20B9A4A5B209C64A76E75C8378BDC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### BVL CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, organizationalUnitName=Referat Z03, commonName=BVL CA, emailAddress=pki@bvl.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 136F03B9BC0CE1
- SHA-256: 2FE888FBE29DE82A0704BD2A6B5F80891640BB0E8D3DB697621D212B19916F34
- SPKI SHA-256: 148C87F494BA27E34F37C4B9825D7D1FE431406C07DE7DE362366FAE2591CC2E
- Validity: 2012-03-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5470086349196513 (0x136f03b9bc0ce1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  1 14:22:33 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, OU = Referat Z03, CN = BVL CA, emailAddress = pki@bvl.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F0:15:B8:30:86:DF:A3:01:F6:29:FF:F9:A9:97:7E:E5:F7:93:E9:28
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bvl.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2FE888FBE29DE82A0704BD2A6B5F80891640BB0E8D3DB697621D212B19916F34
    SPKI SHA256: 148C87F494BA27E34F37C4B9825D7D1FE431406C07DE7DE362366FAE2591CC2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### BVL CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, organizationalUnitName=Referat Z03, commonName=BVL CA, emailAddress=pki@bvl.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7001574BC
- SHA-256: DC42A04016815C8CB9FE9838319FCE5F3DD6FDE0EE37817870D419AF3787E990
- SPKI SHA-256: 148C87F494BA27E34F37C4B9825D7D1FE431406C07DE7DE362366FAE2591CC2E
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399857534140 (0x17aff7001574bc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:41 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Bundesamt fuer Verbraucherschutz und Lebensmittelsicherheit, OU = Referat Z03, CN = BVL CA, emailAddress = pki@bvl.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F0:15:B8:30:86:DF:A3:01:F6:29:FF:F9:A9:97:7E:E5:F7:93:E9:28
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@bvl.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC42A04016815C8CB9FE9838319FCE5F3DD6FDE0EE37817870D419AF3787E990
    SPKI SHA256: 148C87F494BA27E34F37C4B9825D7D1FE431406C07DE7DE362366FAE2591CC2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CA der LUH (UH-CA) - G03

- Subject: countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=RRZN, commonName=CA der LUH (UH-CA) - G03
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906104FC65C2
- SHA-256: F9DAC6E413AEF8C6D6EDD6D2D9D00943527DE4D12C8DD75A33B2DC249CD94DDB
- SPKI SHA-256: 5F576887FC281596E6DC9459A0A0438CBF65022DF17E3B480B6607978D4C8962
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670834222530 (0x17906104fc65c2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:28 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz Universitaet Hannover, OU = RRZN, CN = CA der LUH (UH-CA) - G03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D3:FB:E0:4D:E4:4D:88:85:F4:51:A9:6F:79:75:E9:C0:29:21:2E:13
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F9DAC6E413AEF8C6D6EDD6D2D9D00943527DE4D12C8DD75A33B2DC249CD94DDB
    SPKI SHA256: 5F576887FC281596E6DC9459A0A0438CBF65022DF17E3B480B6607978D4C8962
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CA der LUH (UH-CA) - G03

- Subject: countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=RRZN, commonName=CA der LUH (UH-CA) - G03
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A285C3E
- SHA-256: EF834149355C7A3A40B8E66A75281279CD2797E13169A969736EA54C11E1ACAC
- SPKI SHA-256: 5F576887FC281596E6DC9459A0A0438CBF65022DF17E3B480B6607978D4C8962
- Validity: 2007-03-27 to 2019-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170417214 (0xa285c3e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 09:06:55 2007 GMT
            Not After : Mar 26 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz Universitaet Hannover, OU = RRZN, CN = CA der LUH (UH-CA) - G03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D3:FB:E0:4D:E4:4D:88:85:F4:51:A9:6F:79:75:E9:C0:29:21:2E:13
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EF834149355C7A3A40B8E66A75281279CD2797E13169A969736EA54C11E1ACAC
    SPKI SHA256: 5F576887FC281596E6DC9459A0A0438CBF65022DF17E3B480B6607978D4C8962
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### CA der Universitaet Bielefeld - G02

- Subject: countryName=DE, organizationName=Universitaet Bielefeld, commonName=CA der Universitaet Bielefeld - G02, emailAddress=hrz-ra@uni-bielefeld.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D258D603
- SHA-256: 529FB31BDBFB4C74FF626083D9425F5E762A4AACB4D64D05F441AB41EF50D1E8
- SPKI SHA-256: 24DEEC791333AA7D0647E0024F965933E8E2CF7FBEDC2E45DA08FC09F57E6960
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669984642563 (0x179060d258d603)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Bielefeld, CN = CA der Universitaet Bielefeld - G02, emailAddress = hrz-ra@uni-bielefeld.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A2:20:8A:0B:AC:02:CD:81:3C:4B:B7:48:8A:54:AC:B0:04:B6:DC:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hrz-ra@uni-bielefeld.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 529FB31BDBFB4C74FF626083D9425F5E762A4AACB4D64D05F441AB41EF50D1E8
    SPKI SHA256: 24DEEC791333AA7D0647E0024F965933E8E2CF7FBEDC2E45DA08FC09F57E6960
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CA der Universitaet Bielefeld - G02

- Subject: countryName=DE, organizationName=Universitaet Bielefeld, commonName=CA der Universitaet Bielefeld - G02, emailAddress=hrz-ra@uni-bielefeld.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DD66B6
- SHA-256: 79DC69EC0F22EC6A7A6198007A06586F1EE623934E24629EC889DBA371A0ED34
- SPKI SHA-256: 24DEEC791333AA7D0647E0024F965933E8E2CF7FBEDC2E45DA08FC09F57E6960
- Validity: 2007-01-29 to 2019-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165504694 (0x9dd66b6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 29 12:31:35 2007 GMT
            Not After : Jan 28 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Bielefeld, CN = CA der Universitaet Bielefeld - G02, emailAddress = hrz-ra@uni-bielefeld.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A2:20:8A:0B:AC:02:CD:81:3C:4B:B7:48:8A:54:AC:B0:04:B6:DC:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hrz-ra@uni-bielefeld.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 79DC69EC0F22EC6A7A6198007A06586F1EE623934E24629EC889DBA371A0ED34
    SPKI SHA256: 24DEEC791333AA7D0647E0024F965933E8E2CF7FBEDC2E45DA08FC09F57E6960
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### CA der Universitaet zu Luebeck

- Subject: countryName=DE, organizationName=Universitaet zu Luebeck, organizationalUnitName=Institut fuer Medizinische Informatik, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A188766
- SHA-256: C32BC82E83B39A729ADCF82AA3712B10FFF8531AD881430FA4318303D9C26463
- SPKI SHA-256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
- Validity: 2007-03-15 to 2019-03-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169379686 (0xa188766)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 15 08:54:47 2007 GMT
            Not After : Mar 14 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet zu Luebeck, OU = Institut fuer Medizinische Informatik, CN = CA der Universitaet zu Luebeck, emailAddress = pki@uni-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B7:2B:6F:C0:C7:18:10:31:36:17:52:10:75:A1:D0:40:C3:39:34:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C32BC82E83B39A729ADCF82AA3712B10FFF8531AD881430FA4318303D9C26463
    SPKI SHA256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### CA der Universitaet zu Luebeck

- Subject: countryName=DE, organizationName=Universitaet zu Luebeck, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1160E180
- SHA-256: 45EE1A1294FD2BFCDE4DC6A34F6FECF0F65606E0461978F05F73455B8BF5C82B
- SPKI SHA-256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
- Validity: 2011-01-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 291561856 (0x1160e180)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 27 12:24:17 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet zu Luebeck, CN = CA der Universitaet zu Luebeck, emailAddress = pki@uni-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B7:2B:6F:C0:C7:18:10:31:36:17:52:10:75:A1:D0:40:C3:39:34:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 45EE1A1294FD2BFCDE4DC6A34F6FECF0F65606E0461978F05F73455B8BF5C82B
    SPKI SHA256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### CA der Universitaet zu Luebeck

- Subject: countryName=DE, organizationName=Universitaet zu Luebeck, commonName=CA der Universitaet zu Luebeck, emailAddress=pki@uni-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6EC5CA9EA
- SHA-256: 2DF6E437EF7A0C60C9331C1EC2849F4FE6B69F2040DB6E8DA1F09F425768D2D2
- SPKI SHA-256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399526656490 (0x17aff6ec5ca9ea)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:21 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet zu Luebeck, CN = CA der Universitaet zu Luebeck, emailAddress = pki@uni-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B7:2B:6F:C0:C7:18:10:31:36:17:52:10:75:A1:D0:40:C3:39:34:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2DF6E437EF7A0C60C9331C1EC2849F4FE6B69F2040DB6E8DA1F09F425768D2D2
    SPKI SHA256: 76E06E42C8759D22E92AE7A148AAE633D208E075CC089DB33FFAC33E88B8EB23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CA der Westfaelischen Hochschule - G01

- Subject: countryName=DE, organizationName=Westfaelische Hochschule Gelsenkirchen, Bocholt, Recklinghausen, commonName=CA der Westfaelischen Hochschule - G01, emailAddress=ca@w-hs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1840DBFA8C8104
- SHA-256: 8C1EE8F8480678CF953205B2B42C9F416B0C3752FC307D96A88F0C42F0780022
- SPKI SHA-256: D35D2383AA3F93792EE670A3A6F1C9A83E9351FD26E167E411B12E5F64B17853
- Validity: 2014-09-23 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6826712986583300 (0x1840dbfa8c8104)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 23 11:50:02 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, O = "Westfaelische Hochschule Gelsenkirchen, Bocholt, Recklinghausen", CN = CA der Westfaelischen Hochschule - G01, emailAddress = ca@w-hs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                FC:B3:24:2A:8D:D3:86:90:CE:37:BB:1E:D7:F6:F2:F4:C7:AA:5F:28
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@w-hs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C1EE8F8480678CF953205B2B42C9F416B0C3752FC307D96A88F0C42F0780022
    SPKI SHA256: D35D2383AA3F93792EE670A3A6F1C9A83E9351FD26E167E411B12E5F64B17853
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CA Universitaet des Saarlandes

- Subject: countryName=DE, stateOrProvinceName=Saarland, localityName=Saarbruecken, organizationName=Universitaet des Saarlandes, commonName=CA Universitaet des Saarlandes, emailAddress=ca@rz.uni-saarland.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CD35DB1
- SHA-256: 5A41F3566EB5F625AE2A8AC5F3BC2AE90D2656981194973955138C97654B8EF9
- SPKI SHA-256: AA1210026E329FC18A9A12C48DC3A1A04F0C573E86F931A9D7C38D8A3A2EC0A9
- Validity: 2008-08-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 215178673 (0xcd35db1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 26 10:51:13 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Saarland, L = Saarbruecken, O = Universitaet des Saarlandes, CN = CA Universitaet des Saarlandes, emailAddress = ca@rz.uni-saarland.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F6:A6:8C:F0:2B:19:C8:89:FD:E5:8F:85:82:C4:DC:16:38:ED:68:75
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.uni-saarland.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5A41F3566EB5F625AE2A8AC5F3BC2AE90D2656981194973955138C97654B8EF9
    SPKI SHA256: AA1210026E329FC18A9A12C48DC3A1A04F0C573E86F931A9D7C38D8A3A2EC0A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### CA Universitaet des Saarlandes

- Subject: countryName=DE, stateOrProvinceName=Saarland, localityName=Saarbruecken, organizationName=Universitaet des Saarlandes, commonName=CA Universitaet des Saarlandes, emailAddress=ca@rz.uni-saarland.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF693C08574
- SHA-256: A3EE50709892A6CC7C837DEE0C32F7A8E551FA8EE597D05A7B0FFF9352CF930B
- SPKI SHA-256: AA1210026E329FC18A9A12C48DC3A1A04F0C573E86F931A9D7C38D8A3A2EC0A9
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398040028532 (0x17aff693c08574)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Saarland, L = Saarbruecken, O = Universitaet des Saarlandes, CN = CA Universitaet des Saarlandes, emailAddress = ca@rz.uni-saarland.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F6:A6:8C:F0:2B:19:C8:89:FD:E5:8F:85:82:C4:DC:16:38:ED:68:75
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.uni-saarland.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A3EE50709892A6CC7C837DEE0C32F7A8E551FA8EE597D05A7B0FFF9352CF930B
    SPKI SHA256: AA1210026E329FC18A9A12C48DC3A1A04F0C573E86F931A9D7C38D8A3A2EC0A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Campus Berlin-Buch CA - G02

- Subject: countryName=DE, organizationName=Campus Berlin-Buch, organizationalUnitName=Campus-IT, commonName=Campus Berlin-Buch CA - G02, emailAddress=ca@bbb-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A581B8F
- SHA-256: E9E1F43BA1922634B2ABE49DE678B67CD1C907DA8130F517FBB63DB462A1F070
- SPKI SHA-256: CD4B6BA76B2F99AA5B9C8509129C6D966923B7BC1BFF693EBC30AD80A70C71D8
- Validity: 2007-05-02 to 2019-05-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 173546383 (0xa581b8f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  2 14:19:45 2007 GMT
            Not After : May  1 00:00:00 2019 GMT
        Subject: C = DE, O = Campus Berlin-Buch, OU = Campus-IT, CN = Campus Berlin-Buch CA - G02, emailAddress = ca@bbb-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                58:5E:8C:1A:A0:70:21:59:56:B1:2E:23:FC:E3:21:AC:CA:19:12:57
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bbb-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E9E1F43BA1922634B2ABE49DE678B67CD1C907DA8130F517FBB63DB462A1F070
    SPKI SHA256: CD4B6BA76B2F99AA5B9C8509129C6D966923B7BC1BFF693EBC30AD80A70C71D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Campus Berlin-Buch CA - G02

- Subject: countryName=DE, organizationName=Campus Berlin-Buch, organizationalUnitName=Campus-IT, commonName=Campus Berlin-Buch CA - G02, emailAddress=ca@bbb-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790611503C226
- SHA-256: 328CFA2854B48D4557E440201B1ABB3CDAEA1BB12874D9E970E0D0042B59D927
- SPKI SHA-256: CD4B6BA76B2F99AA5B9C8509129C6D966923B7BC1BFF693EBC30AD80A70C71D8
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671103140390 (0x1790611503c226)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Campus Berlin-Buch, OU = Campus-IT, CN = Campus Berlin-Buch CA - G02, emailAddress = ca@bbb-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                58:5E:8C:1A:A0:70:21:59:56:B1:2E:23:FC:E3:21:AC:CA:19:12:57
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bbb-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 328CFA2854B48D4557E440201B1ABB3CDAEA1BB12874D9E970E0D0042B59D927
    SPKI SHA256: CD4B6BA76B2F99AA5B9C8509129C6D966923B7BC1BFF693EBC30AD80A70C71D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CCC LUH CA ERP-Service

- Subject: countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=ERP-Service, commonName=CCC LUH CA ERP-Service, emailAddress=ccc-luh-ca@ca.uni-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15DFAFE012496C
- SHA-256: E4D11F49F565E10C7B54E61AEC20931A902C54FB66A44A536BF35E8A3F3D395C
- SPKI SHA-256: 6BFCB1EFE2F02868FAB0A6D0AABC08F746E311B2279034B7BECF332D82AC2EAC
- Validity: 2013-06-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6156920982489452 (0x15dfafe012496c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 18 10:11:28 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz Universitaet Hannover, OU = ERP-Service, CN = CCC LUH CA ERP-Service, emailAddress = ccc-luh-ca@ca.uni-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D4:DE:AE:7A:B1:C3:01:A9:93:3B:C6:92:6D:B4:25:EA:73:4E:A6:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ccc-luh-ca@ca.uni-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E4D11F49F565E10C7B54E61AEC20931A902C54FB66A44A536BF35E8A3F3D395C
    SPKI SHA256: 6BFCB1EFE2F02868FAB0A6D0AABC08F746E311B2279034B7BECF332D82AC2EAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CCC LUH CA ERP-Service

- Subject: countryName=DE, organizationName=Leibniz Universitaet Hannover, organizationalUnitName=ERP-Service, commonName=CCC LUH CA ERP-Service, emailAddress=ccc-luh-ca@ca.uni-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7183C6717
- SHA-256: DF5FC310F815C8A06A5BA90092D0EF8FFD103419D04D77F73666DC7F0979B4A5
- SPKI SHA-256: 6BFCB1EFE2F02868FAB0A6D0AABC08F746E311B2279034B7BECF332D82AC2EAC
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400262739735 (0x17aff7183c6717)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:04 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz Universitaet Hannover, OU = ERP-Service, CN = CCC LUH CA ERP-Service, emailAddress = ccc-luh-ca@ca.uni-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D4:DE:AE:7A:B1:C3:01:A9:93:3B:C6:92:6D:B4:25:EA:73:4E:A6:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ccc-luh-ca@ca.uni-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DF5FC310F815C8A06A5BA90092D0EF8FFD103419D04D77F73666DC7F0979B4A5
    SPKI SHA256: 6BFCB1EFE2F02868FAB0A6D0AABC08F746E311B2279034B7BECF332D82AC2EAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Charite CA - G02

- Subject: countryName=DE, organizationName=Charite - Universitaetsmedizin Berlin, organizationalUnitName=IT-Zentrum, commonName=Charite CA - G02, emailAddress=pki@charite.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F274F7
- SHA-256: 5D918C2C95E60A1F0A570FF51D449D6DE67DFB259F71186F9805FAF2E2F32374
- SPKI SHA-256: CE5D5D255CD3AC74F9F40CFF3C47146414D2925EB55261A20F08BC7EC8DA11C2
- Validity: 2007-02-14 to 2019-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166884599 (0x9f274f7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 14 11:50:00 2007 GMT
            Not After : Feb 13 00:00:00 2019 GMT
        Subject: C = DE, O = Charite - Universitaetsmedizin Berlin, OU = IT-Zentrum, CN = Charite CA - G02, emailAddress = pki@charite.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                74:4A:0E:59:EA:22:31:7A:B8:EF:9A:07:92:4D:DF:D2:39:33:A9:C6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@charite.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5D918C2C95E60A1F0A570FF51D449D6DE67DFB259F71186F9805FAF2E2F32374
    SPKI SHA256: CE5D5D255CD3AC74F9F40CFF3C47146414D2925EB55261A20F08BC7EC8DA11C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Charite CA - G02

- Subject: countryName=DE, organizationName=Charite - Universitaetsmedizin Berlin, organizationalUnitName=IT-Zentrum, commonName=Charite CA - G02, emailAddress=pki@charite.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E3156374
- SHA-256: 4DEDE6F5C04B0A8FF037F9DCF637814F21F8929695EB1A63A784FF01ED2D8983
- SPKI SHA-256: CE5D5D255CD3AC74F9F40CFF3C47146414D2925EB55261A20F08BC7EC8DA11C2
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670265434996 (0x179060e3156374)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Charite - Universitaetsmedizin Berlin, OU = IT-Zentrum, CN = Charite CA - G02, emailAddress = pki@charite.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                74:4A:0E:59:EA:22:31:7A:B8:EF:9A:07:92:4D:DF:D2:39:33:A9:C6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@charite.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DEDE6F5C04B0A8FF037F9DCF637814F21F8929695EB1A63A784FF01ED2D8983
    SPKI SHA256: CE5D5D255CD3AC74F9F40CFF3C47146414D2925EB55261A20F08BC7EC8DA11C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CUTEC CA

- Subject: countryName=DE, organizationName=Clausthaler Umwelttechnik-Institut GmbH, commonName=CUTEC CA, emailAddress=ca@cutec.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F5059CD3
- SHA-256: 94349A13C0393D08C0F1CF81D37A7C123DAB0C063B6E7175BA74AEAC3FCE5DEF
- SPKI SHA-256: 18F41BE3F3D73CD1066CC4E3A3298D4289C7F107875E4285E2DF7BDF8CCC2972
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399671946451 (0x17aff6f5059cd3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Clausthaler Umwelttechnik-Institut GmbH, CN = CUTEC CA, emailAddress = ca@cutec.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A4:FE:05:6F:1D:FD:50:6F:BB:1F:C4:6F:D6:DC:DF:83:5C:35:24:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@cutec.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 94349A13C0393D08C0F1CF81D37A7C123DAB0C063B6E7175BA74AEAC3FCE5DEF
    SPKI SHA256: 18F41BE3F3D73CD1066CC4E3A3298D4289C7F107875E4285E2DF7BDF8CCC2972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CUTEC CA

- Subject: countryName=DE, organizationName=Clausthaler Umwelttechnik-Institut GmbH, commonName=CUTEC CA, emailAddress=ca@cutec.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1296A7F9098C68
- SHA-256: 414882A982446A9C8EE2AB081B7A6E84024D0612636DD1F6F15737E49A00723D
- SPKI SHA-256: 18F41BE3F3D73CD1066CC4E3A3298D4289C7F107875E4285E2DF7BDF8CCC2972
- Validity: 2011-09-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5232197762649192 (0x1296a7f9098c68)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 19 11:41:29 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Clausthaler Umwelttechnik-Institut GmbH, CN = CUTEC CA, emailAddress = ca@cutec.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A4:FE:05:6F:1D:FD:50:6F:BB:1F:C4:6F:D6:DC:DF:83:5C:35:24:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@cutec.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 414882A982446A9C8EE2AB081B7A6E84024D0612636DD1F6F15737E49A00723D
    SPKI SHA256: 18F41BE3F3D73CD1066CC4E3A3298D4289C7F107875E4285E2DF7BDF8CCC2972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DBFZ CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, commonName=DBFZ CA, emailAddress=pki@dbfz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6CE550964
- SHA-256: 0AC74907653C0E4CBDE18257EEE4443E1EFD44463FBEADB9E58BDA9A17D26989
- SPKI SHA-256: BEFCD592375118B2314966BCC61228107CFA6090AE5DEF127A4621731928EDAA
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399022840164 (0x17aff6ce550964)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:50 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, CN = DBFZ CA, emailAddress = pki@dbfz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BA:91:A9:FE:C7:AD:C6:68:90:04:D9:42:94:1A:4B:EF:35:71:91:0B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dbfz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0AC74907653C0E4CBDE18257EEE4443E1EFD44463FBEADB9E58BDA9A17D26989
    SPKI SHA256: BEFCD592375118B2314966BCC61228107CFA6090AE5DEF127A4621731928EDAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DBFZ CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, commonName=DBFZ CA, emailAddress=pki@dbfz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F87AF34
- SHA-256: EDEC4EF2BE1C43996BAE81EE1D32E3BE727DBD73A3E75FB3ADC95FD55D7185DC
- SPKI SHA-256: BEFCD592375118B2314966BCC61228107CFA6090AE5DEF127A4621731928EDAA
- Validity: 2010-02-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 260550452 (0xf87af34)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  2 14:07:32 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH, CN = DBFZ CA, emailAddress = pki@dbfz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BA:91:A9:FE:C7:AD:C6:68:90:04:D9:42:94:1A:4B:EF:35:71:91:0B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dbfz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EDEC4EF2BE1C43996BAE81EE1D32E3BE727DBD73A3E75FB3ADC95FD55D7185DC
    SPKI SHA256: BEFCD592375118B2314966BCC61228107CFA6090AE5DEF127A4621731928EDAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DESY CA - G02

- Subject: countryName=DE, organizationName=Deutsches Elektronen-Synchrotron DESY, organizationalUnitName=IT, commonName=DESY CA - G02, emailAddress=desy-ca@desy.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A022341
- SHA-256: DF838AAD6AEAFF8C3795B3C1589D902A97910545541F16EFA3ED800B77794EF8
- SPKI SHA-256: 2DBCA983BE7F2146FA10550D2B9EC3A52120ECE146DE50E968C5563B09D6E22E
- Validity: 2007-02-26 to 2019-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167912257 (0xa022341)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 09:17:39 2007 GMT
            Not After : Feb 25 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Elektronen-Synchrotron DESY, OU = IT, CN = DESY CA - G02, emailAddress = desy-ca@desy.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                94:97:E7:C7:73:80:82:22:8E:72:FA:FF:DD:9E:34:85:E3:B4:76:14
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:desy-ca@desy.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DF838AAD6AEAFF8C3795B3C1589D902A97910545541F16EFA3ED800B77794EF8
    SPKI SHA256: 2DBCA983BE7F2146FA10550D2B9EC3A52120ECE146DE50E968C5563B09D6E22E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DESY CA - G02

- Subject: countryName=DE, organizationName=Deutsches Elektronen-Synchrotron DESY, organizationalUnitName=IT, commonName=DESY CA - G02, emailAddress=desy-ca@desy.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E9B25DEA
- SHA-256: 2DA77357C72CA92D7B4E307308CFA78E3B534D24CE8E707BE79468DB077761C5
- SPKI SHA-256: 2DBCA983BE7F2146FA10550D2B9EC3A52120ECE146DE50E968C5563B09D6E22E
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670376386026 (0x179060e9b25dea)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:01 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsches Elektronen-Synchrotron DESY, OU = IT, CN = DESY CA - G02, emailAddress = desy-ca@desy.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                94:97:E7:C7:73:80:82:22:8E:72:FA:FF:DD:9E:34:85:E3:B4:76:14
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:desy-ca@desy.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2DA77357C72CA92D7B4E307308CFA78E3B534D24CE8E707BE79468DB077761C5
    SPKI SHA256: 2DBCA983BE7F2146FA10550D2B9EC3A52120ECE146DE50E968C5563B09D6E22E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Kinemathek CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsche Kinemathek - Museum fuer Film und Fernsehen, organizationalUnitName=IT-Projekte, commonName=Deutsche Kinemathek CA, emailAddress=admin@deutsche-kinemathek.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F95A7011
- SHA-256: F005588F2C99F0C870404369D8AD76CD09ED8D47C6F81A8598F0868C7145E14A
- SPKI SHA-256: 6F5A362516EA6310312F52B5875776EFC50174F88C8EE3ECF1DCB4DA5D4BB1F8
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399744614417 (0x17aff6f95a7011)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:33 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsche Kinemathek - Museum fuer Film und Fernsehen, OU = IT-Projekte, CN = Deutsche Kinemathek CA, emailAddress = admin@deutsche-kinemathek.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                14:6F:3C:D3:4E:A6:4B:29:5A:09:7A:C6:F6:50:C6:15:E3:CC:39:56
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admin@deutsche-kinemathek.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F005588F2C99F0C870404369D8AD76CD09ED8D47C6F81A8598F0868C7145E14A
    SPKI SHA256: 6F5A362516EA6310312F52B5875776EFC50174F88C8EE3ECF1DCB4DA5D4BB1F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Kinemathek CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsche Kinemathek - Museum fuer Film und Fernsehen, organizationalUnitName=IT-Projekte, commonName=Deutsche Kinemathek CA, emailAddress=admin@deutsche-kinemathek.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12BF64D3A5BC6B
- SHA-256: C52225664FF7071528058020CA8113729241C6E37F0ADD997166E8FB392F6E30
- SPKI SHA-256: 6F5A362516EA6310312F52B5875776EFC50174F88C8EE3ECF1DCB4DA5D4BB1F8
- Validity: 2011-10-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5276989349280875 (0x12bf64d3a5bc6b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 20 09:17:56 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsche Kinemathek - Museum fuer Film und Fernsehen, OU = IT-Projekte, CN = Deutsche Kinemathek CA, emailAddress = admin@deutsche-kinemathek.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                14:6F:3C:D3:4E:A6:4B:29:5A:09:7A:C6:F6:50:C6:15:E3:CC:39:56
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admin@deutsche-kinemathek.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C52225664FF7071528058020CA8113729241C6E37F0ADD997166E8FB392F6E30
    SPKI SHA256: 6F5A362516EA6310312F52B5875776EFC50174F88C8EE3ECF1DCB4DA5D4BB1F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsche Sporthochschule Koeln - CA

- Subject: countryName=DE, organizationName=Deutsche Sporthochschule Koeln, organizationalUnitName=Informations- und Kommunikationstechnologiezentrum, commonName=Deutsche Sporthochschule Koeln - CA, emailAddress=iuk@dshs-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 13E5472FD755B8
- SHA-256: 3CD2075F6D2AF04F83A53D120EE9C062DEF351DF8E4D12F5014FA3241D9636CE
- SPKI SHA-256: E5F8C19DB0EE35784F8500C7D4BE756ED46A1BBE99F4A03117064489B0B72CC0
- Validity: 2012-05-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5600118465582520 (0x13e5472fd755b8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 30 07:17:52 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsche Sporthochschule Koeln, OU = Informations- und Kommunikationstechnologiezentrum, CN = Deutsche Sporthochschule Koeln - CA, emailAddress = iuk@dshs-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CE:AE:2E:00:17:A0:90:35:44:24:36:5F:23:7B:A7:2A:A6:66:B5:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:iuk@dshs-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3CD2075F6D2AF04F83A53D120EE9C062DEF351DF8E4D12F5014FA3241D9636CE
    SPKI SHA256: E5F8C19DB0EE35784F8500C7D4BE756ED46A1BBE99F4A03117064489B0B72CC0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsche Sporthochschule Koeln - CA

- Subject: countryName=DE, organizationName=Deutsche Sporthochschule Koeln, organizationalUnitName=Informations- und Kommunikationstechnologiezentrum, commonName=Deutsche Sporthochschule Koeln - CA, emailAddress=iuk@dshs-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7052F4179
- SHA-256: 080D5EFD11AA24F529F4DDBE4582A7907D8BE327C84D767A11A09D82432188BB
- SPKI SHA-256: E5F8C19DB0EE35784F8500C7D4BE756ED46A1BBE99F4A03117064489B0B72CC0
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399943111033 (0x17aff7052f4179)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsche Sporthochschule Koeln, OU = Informations- und Kommunikationstechnologiezentrum, CN = Deutsche Sporthochschule Koeln - CA, emailAddress = iuk@dshs-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CE:AE:2E:00:17:A0:90:35:44:24:36:5F:23:7B:A7:2A:A6:66:B5:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:iuk@dshs-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 080D5EFD11AA24F529F4DDBE4582A7907D8BE327C84D767A11A09D82432188BB
    SPKI SHA256: E5F8C19DB0EE35784F8500C7D4BE756ED46A1BBE99F4A03117064489B0B72CC0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG Issuing CA 01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 0115
- SHA-256: DAEDC323ED85FACFB7A03EE6E35EB4F6119E46E9227BB5A3AB080A0685077DCC
- SPKI SHA-256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
- Validity: 2011-04-14 to 2019-04-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://corporate-pki.telekom.de/en/cps/cps.htm, https://corporate-pki.telekom.de/en/cps/cps.htm
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-cpki.telekom.de/ocsp
- CRL DP: http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 277 (0x115)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Apr 14 11:37:00 2011 GMT
            Not After : Apr 14 23:59:59 2019 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                86:45:E4:48:42:A8:6C:B8:4E:2D:C5:76:AB:C0:8C:F6:65:51:FC:F3
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki1.telekom.de/cps/cps.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki.telekom.de/ocsp
                CA Issuers - URI:http://corporate-pki.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DAEDC323ED85FACFB7A03EE6E35EB4F6119E46E9227BB5A3AB080A0685077DCC
    SPKI SHA256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp-cpki.telekom.de/ocsp
- AIA CA Issuers: http://corporate-pki.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt, ldap://ldap-cpki.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG Issuing CA 01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 22C58380932FEEE6
- SHA-256: F20F9FAE72DA4902D6FE5ED821AF034D6EDCBD02D53702B636FDA39ABD33ED80
- SPKI SHA-256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
- Validity: 2014-10-16 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-cpki.telekom.de/ocsp
- CRL DP: http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2505553355949993702 (0x22c58380932feee6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Oct 16 11:32:46 2014 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                86:45:E4:48:42:A8:6C:B8:4E:2D:C5:76:AB:C0:8C:F6:65:51:FC:F3
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki.telekom.de/cps/cps.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki.telekom.de/ocsp
                CA Issuers - URI:http://corporate-pki.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F20F9FAE72DA4902D6FE5ED821AF034D6EDCBD02D53702B636FDA39ABD33ED80
    SPKI SHA256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp-cpki.telekom.de/ocsp
- AIA CA Issuers: http://corporate-pki.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt, ldap://ldap-cpki.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://corporate-pki.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG Issuing CA 01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA 01
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: EEDB860E523B2E43
- SHA-256: C6193077C6189D1DFBBF813B87DC7CBF0498ACF727887BC7EC54320906DE9BC8
- SPKI SHA-256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
- Validity: 2016-07-13 to 2026-07-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Deutsche Telekom
- CP/CPS: https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf, https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ee:db:86:0e:52:3b:2e:43
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jul 13 14:51:48 2016 GMT
            Not After : Jul 13 23:59:59 2026 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
            X509v3 Subject Key Identifier:
                86:45:E4:48:42:A8:6C:B8:4E:2D:C5:76:AB:C0:8C:F6:65:51:FC:F3
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://cpki.telekom.de/cps/cpki.htm
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?cACertificate
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C6193077C6189D1DFBBF813B87DC7CBF0498ACF727887BC7EC54320906DE9BC8
    SPKI SHA256: E85299D175122F290627F1931C561EA0DD0819850B4FFBFE153D02210828FFD9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] error e_sub_cert_eku_server_auth_client_auth_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG Issuing CA i01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG Issuing CA i01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 46A157C463EE035F
- SHA-256: 93A65F142BAD10D7F440DE30756ECE515DC4515F3E95ED701F7C9429C7D999EF
- SPKI SHA-256: 03192A37EED9024AB1F790BFC8BF45BB02298F0D99C1229E7C8511E47657FB4F
- Validity: 2014-01-09 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://corporate-pki1.telekom.de/cps/cps.htm, http://corporate-pki1.telekom.de/cps/cps.htm
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-cpki1.telekom.de/ocsp
- CRL DP: http://corporate-pki1.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki1.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5089445554907120479 (0x46a157c463ee035f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jan  9 13:42:15 2014 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG Issuing CA i01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B4:0E:74:8D:D5:53:7C:3E:0A:F7:8A:D2:A7:BB:15:48:55:54:E8:9E
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki1.telekom.de/cps/cps.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://corporate-pki1.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl
                Full Name:
                  URI:ldap://ldap-cpki1.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki1.telekom.de/ocsp
                CA Issuers - URI:http://corporate-pki1.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt
                CA Issuers - URI:ldap://ldap-cpki1.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 93A65F142BAD10D7F440DE30756ECE515DC4515F3E95ED701F7C9429C7D999EF
    SPKI SHA256: 03192A37EED9024AB1F790BFC8BF45BB02298F0D99C1229E7C8511E47657FB4F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp-cpki1.telekom.de/ocsp
- AIA CA Issuers: http://corporate-pki1.telekom.de/aia/Deutsche%20Telekom%20Root%20CA%202.crt, ldap://ldap-cpki1.telekom.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://corporate-pki1.telekom.de/cdp/Deutsche%20Telekom%20Root%20CA%202.crl, ldap://ldap-cpki1.telekom.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG secure email CA

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG secure email CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 1531B1A1347C85A97A37F60EBB50FD86
- SHA-256: D0805A3E6A628E9405613023DE87827A76118DC116B64903D3E75B9DDF4BDB97
- SPKI SHA-256: C90921329CC8C4A037B426DDB2C66B3C04DFDB4548E897C7FEA6B5B30BD77491
- Validity: 2019-04-09 to 2029-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-cpki.telekom.de/rl/Deutsche_Telekom_AG_secure_email_CA.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":true,"critical":false,"permitted":["email:telekom.de","email:external.telekom.de","email:t-systems.com","email:external.t-systems.com","email:pasm.de","email:external.pasm.de","email:dfmg.de","email:external.dfmg.de","email:o-s.de","email:external.o-s.de","email:agv-comunity.de","email:external.agv-comunity.de","email:osp.telekom.de","email:telekom.com","email:external.telekom.com","email:sds.at","email:external.sds.at","email:itenos.de","email:external.itenos.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            15:31:b1:a1:34:7c:85:a9:7a:37:f6:0e:bb:50:fd:86
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Apr  9 13:00:18 2019 GMT
            Not After : Apr  9 23:59:59 2029 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG secure email CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
            X509v3 Subject Key Identifier:
                F5:D3:39:FC:E0:B8:43:73:B6:9F:A7:BC:13:2D:17:2E:F8:D5:64:0E
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://cpki.telekom.de/cps/cpki.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?cACertificate
            X509v3 Name Constraints:
                Permitted:
                  email:telekom.de
                  email:external.telekom.de
                  email:t-systems.com
                  email:external.t-systems.com
                  email:pasm.de
                  email:external.pasm.de
                  email:dfmg.de
                  email:external.dfmg.de
                  email:o-s.de
                  email:external.o-s.de
                  email:agv-comunity.de
                  email:external.agv-comunity.de
                  email:osp.telekom.de
                  email:telekom.com
                  email:external.telekom.com
                  email:sds.at
                  email:external.sds.at
                  email:itenos.de
                  email:external.itenos.de
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D0805A3E6A628E9405613023DE87827A76118DC116B64903D3E75B9DDF4BDB97
    SPKI SHA256: C90921329CC8C4A037B426DDB2C66B3C04DFDB4548E897C7FEA6B5B30BD77491
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":true,"critical":false,"permitted":["email:telekom.de","email:external.telekom.de","email:t-systems.com","email:external.t-systems.com","email:pasm.de","email:external.pasm.de","email:dfmg.de","email:external.dfmg.de","email:o-s.de","email:external.o-s.de","email:agv-comunity.de","email:external.agv-comunity.de","email:osp.telekom.de","email:telekom.com","email:external.telekom.com","email:sds.at","email:external.sds.at","email:itenos.de","email:external.itenos.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG secure email CA

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=Trust Center, commonName=Deutsche Telekom AG secure email CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 7581AA9F9830A3ABBF5BB69F84D856
- SHA-256: 1ACF28AA8C5303EFE5C30118623936B6F501F94D3BB7AD35B810B764345F4F01
- SPKI SHA-256: C90921329CC8C4A037B426DDB2C66B3C04DFDB4548E897C7FEA6B5B30BD77491
- Validity: 2018-01-18 to 2028-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/CP-CPS_CPKI_DTAG_SecureEmail_20200727_v.08.00_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-cpki.telekom.de/rl/Deutsche_Telekom_AG_secure_email_CA.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":true,"critical":false,"permitted":["email:telekom.de","email:external.telekom.de","email:t-systems.com","email:external.t-systems.com","email:pasm.de","email:external.pasm.de","email:dfmg.de","email:external.dfmg.de","email:o-s.de","email:external.o-s.de","email:agv-comunity.de","email:external.agv-comunity.de","email:osp.telekom.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:81:aa:9f:98:30:a3:ab:bf:5b:b6:9f:84:d8:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jan 18 11:04:58 2018 GMT
            Not After : Jan 18 23:59:59 2028 GMT
        Subject: C = DE, O = Deutsche Telekom AG, OU = Trust Center, CN = Deutsche Telekom AG secure email CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
            X509v3 Subject Key Identifier:
                F5:D3:39:FC:E0:B8:43:73:B6:9F:A7:BC:13:2D:17:2E:F8:D5:64:0E
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://cpki.telekom.de/cps/cpki.htm
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?cACertificate
            X509v3 Name Constraints:
                Permitted:
                  email:telekom.de
                  email:external.telekom.de
                  email:t-systems.com
                  email:external.t-systems.com
                  email:pasm.de
                  email:external.pasm.de
                  email:dfmg.de
                  email:external.dfmg.de
                  email:o-s.de
                  email:external.o-s.de
                  email:agv-comunity.de
                  email:external.agv-comunity.de
                  email:osp.telekom.de
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1ACF28AA8C5303EFE5C30118623936B6F501F94D3BB7AD35B810B764345F4F01
    SPKI SHA256: C90921329CC8C4A037B426DDB2C66B3C04DFDB4548E897C7FEA6B5B30BD77491
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":true,"critical":false,"permitted":["email:telekom.de","email:external.telekom.de","email:t-systems.com","email:external.t-systems.com","email:pasm.de","email:external.pasm.de","email:dfmg.de","email:external.dfmg.de","email:o-s.de","email:external.o-s.de","email:agv-comunity.de","email:external.agv-comunity.de","email:osp.telekom.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] error e_sub_cert_eku_server_auth_client_auth_missing: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG secure email CA E02

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E02
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 34D22925006C85582FE89B82D7976D59
- SHA-256: 029379118E5775226C54D7182A367A240B51770F5011BB35177CFD17D9B2445A
- SPKI SHA-256: DB5DA5EA5C6B480F3DF24B724B2C385E447FB56E7C62DB0D1264AB139872D1F7
- Validity: 2020-02-25 to 2030-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf, https://telesec.de/assets/downloads/PKI-Repository/cPKI_SecureEmail_CP_CPS_07.00_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:d2:29:25:00:6c:85:58:2f:e8:9b:82:d7:97:6d:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 25 10:09:31 2020 GMT
            Not After : Feb 25 23:59:59 2030 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG secure email CA E02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
            X509v3 Subject Key Identifier:
                F8:CE:79:3C:48:05:81:52:80:0F:F6:21:F6:B6:0C:01:D5:64:1E:A6
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki.telekom.de/cps/cpki.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?cACertificate
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 029379118E5775226C54D7182A367A240B51770F5011BB35177CFD17D9B2445A
    SPKI SHA256: DB5DA5EA5C6B480F3DF24B724B2C385E447FB56E7C62DB0D1264AB139872D1F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG secure email CA E03

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E03
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 39EC6CFC261ACFBE898FA145705C9B0A
- SHA-256: 38CBC81860C904BDF18046CD0FB7754E44D569398DD14FBF09F72AA20FC35CCF
- SPKI SHA-256: 3036E5F7A5A8F040F66F3654BA27962FBDD9DF6C4897AAACAD831E81FE46692C
- Validity: 2020-07-09 to 2030-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-cpki.telekom.de/rl/Deutsche_Telekom_AG_secure_email_CA_E03.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:ec:6c:fc:26:1a:cf:be:89:8f:a1:45:70:5c:9b:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jul  9 08:22:06 2020 GMT
            Not After : Jul  9 23:59:59 2030 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG secure email CA E03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5
            X509v3 Subject Key Identifier:
                07:47:AD:10:1E:06:F4:A7:74:11:60:A5:BD:A1:2B:37:8A:F3:F3:5D
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki.telekom.de/cps/cpki.htm
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?authorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
                CA Issuers - URI:ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-TeleSec%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?cACertificate
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 38CBC81860C904BDF18046CD0FB7754E44D569398DD14FBF09F72AA20FC35CCF
    SPKI SHA256: 3036E5F7A5A8F040F66F3654BA27962FBDD9DF6C4897AAACAD831E81FE46692C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl, ldap://ldap-cpki.telekom.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG secure email CA E04

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E04
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 232822156F4A608B523E342995C0AA0D
- SHA-256: 651656EDA8A9765470C57B3692A4FF62D9B05AB5CE1179E866B70F4DAFD754FD
- SPKI SHA-256: 21686351789AA36C6B821D21835E77E7E6547DF9B199B0DD795C6228D84FF0CD
- Validity: 2023-06-20 to 2028-06-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:28:22:15:6f:4a:60:8b:52:3e:34:29:95:c0:aa:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jun 20 09:26:48 2023 GMT
            Not After : Jun 19 23:59:59 2028 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG secure email CA E04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                71:42:B5:01:05:56:CC:E7:9F:E4:C1:12:E5:23:AC:90:A1:17:14:7B
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 651656EDA8A9765470C57B3692A4FF62D9B05AB5CE1179E866B70F4DAFD754FD
    SPKI SHA256: 21686351789AA36C6B821D21835E77E7E6547DF9B199B0DD795C6228D84FF0CD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/GlobalRoot_Class_2.cer
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG secure email CA E05

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG secure email CA E05
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2BE3ED4400F541465610BCA64434A0BB
- SHA-256: 1AB8A68FCBBA644D5C6D2627FE6D943CE4FD3E58619B3B087F3CF4EFA838C46A
- SPKI SHA-256: 87F3F3F1B319E4E1D50AC8DA467404FA0A903C68B792E57505C6C5814818A86E
- Validity: 2023-08-09 to 2028-08-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-cpki.telekom.de/rl/Deutsche_Telekom_AG_secure_email_CA_E05.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:e3:ed:44:00:f5:41:46:56:10:bc:a6:44:34:a0:bb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Aug  9 08:49:15 2023 GMT
            Not After : Aug  8 23:59:59 2028 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG secure email CA E05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                45:EF:6F:A8:A7:9A:E4:EB:CA:CC:5E:4F:A0:5A:95:B2:F5:9A:10:20
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.26
                  CPS: http://corporate-pki.telekom.de/cps/cpki.htm
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1AB8A68FCBBA644D5C6D2627FE6D943CE4FD3E58619B3B087F3CF4EFA838C46A
    SPKI SHA256: 87F3F3F1B319E4E1D50AC8DA467404FA0A903C68B792E57505C6C5814818A86E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.7879.13.26, 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2
- AIA OCSP: http://ocsp.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG SMIME ECC CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG SMIME ECC CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 24E2B5423742B7FA8B593C8F07428328
- SHA-256: 5F8CD9D54A0C2F83C86B999F34C448A4608DC75C4377978A4CC3669B5718BF36
- SPKI SHA-256: F2DE9FFF55DB76DB4557F166D5AF4534B9924589FA6FF259E5D5B890BA14202B
- Validity: 2024-11-26 to 2034-11-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:e2:b5:42:37:42:b7:fa:8b:59:3c:8f:07:42:83:28
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Nov 26 10:47:55 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG SMIME ECC CA 24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:07:58:1D:66:2F:CE:90:07:33:DD:2A:43:4A:C1:7B:31:FF:3C:64
            X509v3 Authority Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 1.3.6.1.4.1.7879.13.26
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5F8CD9D54A0C2F83C86B999F34C448A4608DC75C4377978A4CC3669B5718BF36
    SPKI SHA256: F2DE9FFF55DB76DB4557F166D5AF4534B9924589FA6FF259E5D5B890BA14202B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG SMIME RSA CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, commonName=Deutsche Telekom AG SMIME RSA CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: 0970C3C3D4087362F814731AF6443C72
- SHA-256: 0CE1DAB9D12CD1D587AEF1B7B50B33D682D539F45DF809643A53B6A84935B47B
- SPKI SHA-256: F36830E99D6688B8A1F3D22776020A5B5FA34C6B1C31028EBC333D55BBC2CA64
- Validity: 2024-11-26 to 2034-11-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- CRL DP: http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            09:70:c3:c3:d4:08:73:62:f8:14:73:1a:f6:44:3c:72
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Nov 26 10:45:28 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom AG, CN = Deutsche Telekom AG SMIME RSA CA 24
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CF:54:71:86:E9:E9:5C:7F:E3:64:69:63:E2:5C:3B:FD:D3:7B:EC:92
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://ocsp-cpki.telekom.de/ocspr
                CA Issuers - URI:http://crt-cpki.telekom.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 1.3.6.1.4.1.7879.13.26
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0CE1DAB9D12CD1D587AEF1B7B50B33D682D539F45DF809643A53B6A84935B47B
    SPKI SHA256: F36830E99D6688B8A1F3D22776020A5B5FA34C6B1C31028EBC333D55BBC2CA64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 1.3.6.1.4.1.7879.13.26
- AIA OCSP: http://ocsp-cpki.telekom.de/ocspr
- AIA CA Issuers: http://crt-cpki.telekom.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
- CRL Distribution Points: http://crl-cpki.telekom.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom AG, Laboratories CA - G01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline@laboratories.telekom.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AC92BB8
- SHA-256: FC6D0FD36A56166D395FB5479DDB1E9D2343F78B688A83A21EEEB95C98B4E0F8
- SPKI SHA-256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
- Validity: 2007-07-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180956088 (0xac92bb8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 27 08:34:50 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = "Deutsche Telekom AG, Laboratories", CN = "Deutsche Telekom AG, Laboratories CA - G01", emailAddress = hotline@laboratories.telekom.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                94:54:15:5F:21:C4:40:CC:50:18:FE:F2:61:2A:56:51:AB:B2:A5:2A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hotline@laboratories.telekom.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FC6D0FD36A56166D395FB5479DDB1E9D2343F78B688A83A21EEEB95C98B4E0F8
    SPKI SHA256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG, Laboratories CA - G01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline.laboratories@telekom.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42514B7F5CA
- SHA-256: 836B4A2259B89B9FD315A4FB089725C17E388D78ECE5FB480C0676F1898B58C1
- SPKI SHA-256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403632690634 (0x17a42514b7f5ca)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:04 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = "Deutsche Telekom AG, Laboratories", CN = "Deutsche Telekom AG, Laboratories CA - G01", emailAddress = hotline.laboratories@telekom.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                94:54:15:5F:21:C4:40:CC:50:18:FE:F2:61:2A:56:51:AB:B2:A5:2A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hotline.laboratories@telekom.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 836B4A2259B89B9FD315A4FB089725C17E388D78ECE5FB480C0676F1898B58C1
    SPKI SHA256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom AG, Laboratories CA - G01

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, Laboratories, commonName=Deutsche Telekom AG, Laboratories CA - G01, emailAddress=hotline.laboratories@telekom.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ACEB1A1
- SHA-256: 00C5A1BC2526395793EC34A135E30F246F6295583D1B8E6B924CBA9099730235
- SPKI SHA-256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
- Validity: 2007-07-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 181318049 (0xaceb1a1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 31 13:07:31 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = "Deutsche Telekom AG, Laboratories", CN = "Deutsche Telekom AG, Laboratories CA - G01", emailAddress = hotline.laboratories@telekom.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                94:54:15:5F:21:C4:40:CC:50:18:FE:F2:61:2A:56:51:AB:B2:A5:2A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hotline.laboratories@telekom.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 00C5A1BC2526395793EC34A135E30F246F6295583D1B8E6B924CBA9099730235
    SPKI SHA256: E79592742CED4108D6936424039354777C047644682883A235280BF49EB02E4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsche Telekom SMIME ECC qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME ECC qualified CA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 3CFC1FC0D28B2E78A95AAC260EA4F62A
- SHA-256: 83C873C88056E810D74A71F665A49E76D24838178A101235329D193558B888CE
- SPKI SHA-256: 03F5253634779CF5DDAC5F0AEBF78CC3B948273865BA08DE29F1583344EC0C82
- Validity: 2025-10-23 to 2035-10-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Deutsche_Telekom_SMIME_ECC_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- CRL DP: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:fc:1f:c0:d2:8b:2e:78:a9:5a:ac:26:0e:a4:f6:2a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Oct 23 09:38:56 2025 GMT
            Not After : Oct 22 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom AG, organizationIdentifier = NTRDE-DER3201.HRB6794, CN = Deutsche Telekom SMIME ECC qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                68:08:AE:83:33:45:28:03:E8:9A:EC:53:4A:28:0F:A1:77:95:32:00
            X509v3 Authority Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
            Authority Information Access:
                OCSP - URI:http://tssmer21.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 83C873C88056E810D74A71F665A49E76D24838178A101235329D193558B888CE
    SPKI SHA256: 03F5253634779CF5DDAC5F0AEBF78CC3B948273865BA08DE29F1583344EC0C82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
- CRL Distribution Points: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom SMIME qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME qualified CA 25
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0D56B3366BD32BEEE2B423A196E11F3F
- SHA-256: E84F2DBEA23690D8B850805B335454B0E773AD4C6992C7EF9DD005088CBEF2E1
- SPKI SHA-256: 5A375B4CAEEE513DD99397866C094A913575FA70480F8CE8E129D1840F865683
- Validity: 2025-10-23 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Deutsche_Telekom_SMIME_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:56:b3:36:6b:d3:2b:ee:e2:b4:23:a1:96:e1:1f:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Oct 23 09:27:34 2025 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom AG, organizationIdentifier = NTRDE-DER3201.HRB6794, CN = Deutsche Telekom SMIME qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9F:97:0B:10:55:BD:BB:37:4D:7E:B0:79:F4:01:DA:BF:A5:46:5C:E8
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E84F2DBEA23690D8B850805B335454B0E773AD4C6992C7EF9DD005088CBEF2E1
    SPKI SHA256: 5A375B4CAEEE513DD99397866C094A913575FA70480F8CE8E129D1840F865683
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutsche Telekom SMIME RSA qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom AG, organizationIdentifier=NTRDE-DER3201.HRB6794, commonName=Deutsche Telekom SMIME RSA qualified CA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: 26958CA25F7763365D46AAF76347EFEE
- SHA-256: A7E52B3F5DF5D5122751E167BA343F1B87CCD8E45A9E976D2E0AEE8C7CAEBBD7
- SPKI SHA-256: 7CCC3166E0456D213A65F5B481DA9E12475F64C35E835BB214827F69F2D50C90
- Validity: 2025-10-23 to 2035-10-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Deutsche_Telekom_SMIME_RSA_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:95:8c:a2:5f:77:63:36:5d:46:aa:f7:63:47:ef:ee
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Oct 23 09:42:16 2025 GMT
            Not After : Oct 22 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom AG, organizationIdentifier = NTRDE-DER3201.HRB6794, CN = Deutsche Telekom SMIME RSA qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E5:4D:43:15:3E:26:CC:E0:9D:63:A8:1D:93:29:D5:59:38:20:A6:73
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tssmrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A7E52B3F5DF5D5122751E167BA343F1B87CCD8E45A9E976D2E0AEE8C7CAEBBD7
    SPKI SHA256: 7CCC3166E0456D213A65F5B481DA9E12475F64C35E835BB214827F69F2D50C90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
- CRL Distribution Points: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutscher Bundestag CA - G01

- Subject: countryName=DE, organizationName=Deutscher Bundestag, organizationalUnitName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G01, emailAddress=pki-ca@bundestag.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A3B43276
- SHA-256: 3D7FE14CED1D7DCD805E5BC095CF574D191AC0F3F5E86DFB87C37ED5CAEA400F
- SPKI SHA-256: 1CD1501A7E55B5C7B73D054BCF33317F003C42557DCCE094D2526B4AC663659B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398307656310 (0x17aff6a3b43276)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:07 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutscher Bundestag, OU = Deutscher Bundestag, CN = Deutscher Bundestag CA - G01, emailAddress = pki-ca@bundestag.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                77:8D:95:81:04:0A:E3:55:58:99:D0:0B:C9:B9:5B:E5:22:7E:2E:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@bundestag.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3D7FE14CED1D7DCD805E5BC095CF574D191AC0F3F5E86DFB87C37ED5CAEA400F
    SPKI SHA256: 1CD1501A7E55B5C7B73D054BCF33317F003C42557DCCE094D2526B4AC663659B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutscher Bundestag CA - G01

- Subject: countryName=DE, organizationName=Deutscher Bundestag, organizationalUnitName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G01, emailAddress=pki-ca@bundestag.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D688CAF
- SHA-256: 1E4C24C148CCAE9F5D763B8ED490173A8742847E7715613813FBEFF81D87E6BB
- SPKI SHA-256: 1CD1501A7E55B5C7B73D054BCF33317F003C42557DCCE094D2526B4AC663659B
- Validity: 2008-12-17 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 224955567 (0xd688caf)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 17 14:39:27 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutscher Bundestag, OU = Deutscher Bundestag, CN = Deutscher Bundestag CA - G01, emailAddress = pki-ca@bundestag.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                77:8D:95:81:04:0A:E3:55:58:99:D0:0B:C9:B9:5B:E5:22:7E:2E:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@bundestag.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1E4C24C148CCAE9F5D763B8ED490173A8742847E7715613813FBEFF81D87E6BB
    SPKI SHA256: 1CD1501A7E55B5C7B73D054BCF33317F003C42557DCCE094D2526B4AC663659B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutscher Bundestag CA - G02

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutscher Bundestag, commonName=Deutscher Bundestag CA - G02
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1C3AD46FEC82C025CADB5A8D
- SHA-256: 4C9E0538F985690DE9D5CE1C38F16C24B4C39A1710C0881CDB06E2AFDB757B4D
- SPKI SHA-256: A7E0C6B1951E743A49D22011EAF6A55765D9CA400F23207FB7A15DA82A6C35C9
- Validity: 2016-11-03 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/deutscher-bundestag-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:3a:d4:6f:ec:82:c0:25:ca:db:5a:8d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Nov  3 15:25:19 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutscher Bundestag, CN = Deutscher Bundestag CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                35:AD:C4:CC:FF:4F:20:EA:9C:3A:DE:FB:9C:DD:F9:3D:C4:7D:BA:8F
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4C9E0538F985690DE9D5CE1C38F16C24B4C39A1710C0881CDB06E2AFDB757B4D
    SPKI SHA256: A7E0C6B1951E743A49D22011EAF6A55765D9CA400F23207FB7A15DA82A6C35C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Deutscher Wetterdienst CA - G01

- Subject: countryName=DE, localityName=Offenbach am Main, organizationName=Deutscher Wetterdienst, organizationalUnitName=GB TI Ref. TI 16, commonName=Deutscher Wetterdienst CA - G01, emailAddress=dwd.webssl@dwd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906116A33E17
- SHA-256: A48A127973AFF8C6055DA56A50237EA269E38D611D7890ACD1D59F0D1800565E
- SPKI SHA-256: D90D0E4933C7A25A745D123B5FCB441C5AF4E67673960AFAED55D382184CA757
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671130369559 (0x17906116a33e17)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:46 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Offenbach am Main, O = Deutscher Wetterdienst, OU = GB TI Ref. TI 16, CN = Deutscher Wetterdienst CA - G01, emailAddress = dwd.webssl@dwd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AB:7B:06:57:D9:1C:EE:F9:22:1A:56:9E:60:28:85:C0:EA:A7:FD:47
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dwd.webssl@dwd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A48A127973AFF8C6055DA56A50237EA269E38D611D7890ACD1D59F0D1800565E
    SPKI SHA256: D90D0E4933C7A25A745D123B5FCB441C5AF4E67673960AFAED55D382184CA757
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutscher Wetterdienst CA - G01

- Subject: countryName=DE, localityName=Offenbach am Main, organizationName=Deutscher Wetterdienst, organizationalUnitName=GB TI Ref. TI 16, commonName=Deutscher Wetterdienst CA - G01, emailAddress=dwd.webssl@dwd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A581BA3
- SHA-256: BC29BC1C8EE75F9FEF7DCB176E4BD6D40473182745459ED0FFE271888CD8344F
- SPKI SHA-256: D90D0E4933C7A25A745D123B5FCB441C5AF4E67673960AFAED55D382184CA757
- Validity: 2007-05-02 to 2019-05-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 173546403 (0xa581ba3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  2 14:20:05 2007 GMT
            Not After : May  1 00:00:00 2019 GMT
        Subject: C = DE, L = Offenbach am Main, O = Deutscher Wetterdienst, OU = GB TI Ref. TI 16, CN = Deutscher Wetterdienst CA - G01, emailAddress = dwd.webssl@dwd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:7B:06:57:D9:1C:EE:F9:22:1A:56:9E:60:28:85:C0:EA:A7:FD:47
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dwd.webssl@dwd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BC29BC1C8EE75F9FEF7DCB176E4BD6D40473182745459ED0FFE271888CD8344F
    SPKI SHA256: D90D0E4933C7A25A745D123B5FCB441C5AF4E67673960AFAED55D382184CA757
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsches Archaeologisches Institut - CA G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Archaeologisches Institut, organizationalUnitName=IT, commonName=Deutsches Archaeologisches Institut - CA G01, emailAddress=pkica@dainst.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FB5F6E1
- SHA-256: DD0ACAAE714E98874FC22864E01F58DA4AE84954D694B54B26F007DB2C31D3AB
- SPKI SHA-256: 551B659418239CE606ABF3466636D6D66126460A287961D5A8452B4E9962A744
- Validity: 2010-03-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 263583457 (0xfb5f6e1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  9 16:37:37 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsches Archaeologisches Institut, OU = IT, CN = Deutsches Archaeologisches Institut - CA G01, emailAddress = pkica@dainst.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B0:22:AA:66:A0:DE:E8:A7:B3:63:E9:48:EE:D1:63:DD:03:01:75:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pkica@dainst.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DD0ACAAE714E98874FC22864E01F58DA4AE84954D694B54B26F007DB2C31D3AB
    SPKI SHA256: 551B659418239CE606ABF3466636D6D66126460A287961D5A8452B4E9962A744
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsches Archaeologisches Institut - CA G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Archaeologisches Institut, organizationalUnitName=IT, commonName=Deutsches Archaeologisches Institut - CA G01, emailAddress=pkica@dainst.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D3D194AF
- SHA-256: 6683519976877B29DEBD95F960068BE4CE6F41296B96AEDA3BF892FCCAC10711
- SPKI SHA-256: 551B659418239CE606ABF3466636D6D66126460A287961D5A8452B4E9962A744
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399114888367 (0x17aff6d3d194af)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsches Archaeologisches Institut, OU = IT, CN = Deutsches Archaeologisches Institut - CA G01, emailAddress = pkica@dainst.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B0:22:AA:66:A0:DE:E8:A7:B3:63:E9:48:EE:D1:63:DD:03:01:75:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pkica@dainst.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6683519976877B29DEBD95F960068BE4CE6F41296B96AEDA3BF892FCCAC10711
    SPKI SHA256: 551B659418239CE606ABF3466636D6D66126460A287961D5A8452B4E9962A744
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Deutsches Herzzentrum Berlin Zertifizierungsstelle

- Subject: countryName=DE, localityName=Berlin, organizationName=Deutsches Herzzentrum Berlin, organizationalUnitName=Informationstechnik, commonName=Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress=pki@dhzb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F77FB64
- SHA-256: FCC88568504744D444B32492544D2BC3606EECA38B3E24EA62BA816E0BF4A34B
- SPKI SHA-256: 7C572248727DE25A5FFEB8EF834469942D4A5B384E5D34E8CEBD9FBBED993CCD
- Validity: 2010-01-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 259521380 (0xf77fb64)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 21 16:16:20 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Berlin, O = Deutsches Herzzentrum Berlin, OU = Informationstechnik, CN = Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress = pki@dhzb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A5:3F:61:EB:46:21:5B:8B:94:23:2A:60:B0:AC:5D:1B:16:E6:5C:59
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dhzb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FCC88568504744D444B32492544D2BC3606EECA38B3E24EA62BA816E0BF4A34B
    SPKI SHA256: 7C572248727DE25A5FFEB8EF834469942D4A5B384E5D34E8CEBD9FBBED993CCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Deutsches Herzzentrum Berlin Zertifizierungsstelle

- Subject: countryName=DE, localityName=Berlin, organizationName=Deutsches Herzzentrum Berlin, organizationalUnitName=Informationstechnik, commonName=Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress=pki@dhzb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6CB68BF3E
- SHA-256: B2E7CB005FD78BE2E5E80D64A83CA50F1ACC2DACF9E67A89CB5BFD1DAB3B7198
- SPKI SHA-256: 7C572248727DE25A5FFEB8EF834469942D4A5B384E5D34E8CEBD9FBBED993CCD
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398973800254 (0x17aff6cb68bf3e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:47 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Berlin, O = Deutsches Herzzentrum Berlin, OU = Informationstechnik, CN = Deutsches Herzzentrum Berlin Zertifizierungsstelle, emailAddress = pki@dhzb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A5:3F:61:EB:46:21:5B:8B:94:23:2A:60:B0:AC:5D:1B:16:E6:5C:59
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dhzb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B2E7CB005FD78BE2E5E80D64A83CA50F1ACC2DACF9E67A89CB5BFD1DAB3B7198
    SPKI SHA256: 7C572248727DE25A5FFEB8EF834469942D4A5B384E5D34E8CEBD9FBBED993CCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFG-CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Forschungsgemeinschaft e.V., organizationalUnitName=I-INF-1, commonName=DFG-CA, emailAddress=ca@dfg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E226333
- SHA-256: FA7E11B8963917A52FFCB198546F1DD40CBC40EC1A108D495210856E842A4A35
- SPKI SHA-256: 3D7EF2B39E80455961D40889986405379D2415D6298AA46C685845033E2EFCC4
- Validity: 2009-05-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 237134643 (0xe226333)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  7 13:44:03 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Forschungsgemeinschaft e.V., OU = I-INF-1, CN = DFG-CA, emailAddress = ca@dfg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D3:D0:C1:76:35:A7:38:28:0B:AB:51:8A:5B:23:C4:01:56:F1:C8:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA7E11B8963917A52FFCB198546F1DD40CBC40EC1A108D495210856E842A4A35
    SPKI SHA256: 3D7EF2B39E80455961D40889986405379D2415D6298AA46C685845033E2EFCC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFG-CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Forschungsgemeinschaft e.V., organizationalUnitName=I-INF-1, commonName=DFG-CA, emailAddress=ca@dfg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF74DDB0B23
- SHA-256: 8F513CCF926C752EE7A2CD855DC1E0B04C905D5C1A0249DAEBCABB3C6CFBADD4
- SPKI SHA-256: 3D7EF2B39E80455961D40889986405379D2415D6298AA46C685845033E2EFCC4
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401162328867 (0x17aff74ddb0b23)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Forschungsgemeinschaft e.V., OU = I-INF-1, CN = DFG-CA, emailAddress = ca@dfg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D3:D0:C1:76:35:A7:38:28:0B:AB:51:8A:5B:23:C4:01:56:F1:C8:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F513CCF926C752EE7A2CD855DC1E0B04C905D5C1A0249DAEBCABB3C6CFBADD4
    SPKI SHA256: 3D7EF2B39E80455961D40889986405379D2415D6298AA46C685845033E2EFCC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFKI-CA - G01

- Subject: countryName=DE, organizationName=Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, organizationalUnitName=ISG, commonName=DFKI-CA - G01, emailAddress=ca@dfki.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71CD0145F
- SHA-256: 9074C05A31BE3F16C8637228402A8E43D1660C4EB8910714B53B5AAC1F6C798A
- SPKI SHA-256: E8C458BF7D69E0F5EF4EA40011A49FB58E466B10B86DF23C14FE42BBCA39F64F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400339526751 (0x17aff71cd0145f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:08 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, OU = ISG, CN = DFKI-CA - G01, emailAddress = ca@dfki.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B0:43:D9:01:D3:78:CC:58:AD:87:14:F2:D4:3A:48:AA:70:71:4A:EC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfki.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9074C05A31BE3F16C8637228402A8E43D1660C4EB8910714B53B5AAC1F6C798A
    SPKI SHA256: E8C458BF7D69E0F5EF4EA40011A49FB58E466B10B86DF23C14FE42BBCA39F64F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFKI-CA - G01

- Subject: countryName=DE, organizationName=Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, organizationalUnitName=ISG, commonName=DFKI-CA - G01, emailAddress=ca@dfki.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 16500ADC2664CB
- SHA-256: B74A87A139697D46C1B9A3F8B4EF8AE772E59B280CCC4084A2E3A0FFBB7B9BA9
- SPKI SHA-256: E8C458BF7D69E0F5EF4EA40011A49FB58E466B10B86DF23C14FE42BBCA39F64F
- Validity: 2013-09-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6280457061033163 (0x16500adc2664cb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 11 15:33:32 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Forschungszentrum fuer Kuenstliche Intelligenz GmbH, OU = ISG, CN = DFKI-CA - G01, emailAddress = ca@dfki.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B0:43:D9:01:D3:78:CC:58:AD:87:14:F2:D4:3A:48:AA:70:71:4A:EC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfki.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B74A87A139697D46C1B9A3F8B4EF8AE772E59B280CCC4084A2E3A0FFBB7B9BA9
    SPKI SHA256: E8C458BF7D69E0F5EF4EA40011A49FB58E466B10B86DF23C14FE42BBCA39F64F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-CA Global

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-CA Global
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F2238836
- SHA-256: 3801CA5F0749C56D940361D145366E1C63D069435D4B9C2FBC0B081F338869C9
- SPKI SHA-256: 3AC48CC2558D1EA082E6B060B32ABC10917A5592EDCED1CC89639EAE26B29CDB
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399623575606 (0x17aff6f2238836)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-CA Global
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3D:24:A4:99:23:28:95:35:6F:BC:58:9F:6F:50:88:45:EF:37:30:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3801CA5F0749C56D940361D145366E1C63D069435D4B9C2FBC0B081F338869C9
    SPKI SHA256: 3AC48CC2558D1EA082E6B060B32ABC10917A5592EDCED1CC89639EAE26B29CDB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-CA Global

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-CA Global
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 11B502CF
- SHA-256: 512A9162F55C00112E862071292ADA14514719C46733F6559538169EA9A2ED6C
- SPKI SHA-256: 3AC48CC2558D1EA082E6B060B32ABC10917A5592EDCED1CC89639EAE26B29CDB
- Validity: 2011-04-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 297075407 (0x11b502cf)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  1 07:56:47 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-CA Global
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3D:24:A4:99:23:28:95:35:6F:BC:58:9F:6F:50:88:45:EF:37:30:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 512A9162F55C00112E862071292ADA14514719C46733F6559538169EA9A2ED6C
    SPKI SHA256: 3AC48CC2558D1EA082E6B060B32ABC10917A5592EDCED1CC89639EAE26B29CDB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-CERT Services GmbH CA - G02

- Subject: countryName=DE, organizationName=DFN-CERT Services GmbH, commonName=DFN-CERT Services GmbH CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F27500
- SHA-256: D5CF5B803624E04BE463D9AB1405D90A26B39289256C1F19A3359EEEBF43F2C3
- SPKI SHA-256: 6F5293CD3CD3132986632ADC0130C8A687754C86352D69940BBE6A6B638E9C32
- Validity: 2007-02-14 to 2019-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166884608 (0x9f27500)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 14 11:50:09 2007 GMT
            Not After : Feb 13 00:00:00 2019 GMT
        Subject: C = DE, O = DFN-CERT Services GmbH, CN = DFN-CERT Services GmbH CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C6:8B:CF:FA:44:FC:3A:6A:4B:68:AB:E8:E7:BF:38:23:E5:BA:0A:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D5CF5B803624E04BE463D9AB1405D90A26B39289256C1F19A3359EEEBF43F2C3
    SPKI SHA256: 6F5293CD3CD3132986632ADC0130C8A687754C86352D69940BBE6A6B638E9C32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-CERT Services GmbH CA - G02

- Subject: countryName=DE, organizationName=DFN-CERT Services GmbH, commonName=DFN-CERT Services GmbH CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 175108F4184AC6
- SHA-256: 5D712D54C34B3174CA55DAC1DA9728CB39F63961AAC087E41D3E52E4ED1756E2
- SPKI SHA-256: 6F5293CD3CD3132986632ADC0130C8A687754C86352D69940BBE6A6B638E9C32
- Validity: 2014-03-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6563023361166022 (0x175108f4184ac6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 25 13:57:57 2014 GMT
            Not After : Jun 30 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-CERT Services GmbH, CN = DFN-CERT Services GmbH CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C6:8B:CF:FA:44:FC:3A:6A:4B:68:AB:E8:E7:BF:38:23:E5:BA:0A:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5D712D54C34B3174CA55DAC1DA9728CB39F63961AAC087E41D3E52E4ED1756E2
    SPKI SHA256: 6F5293CD3CD3132986632ADC0130C8A687754C86352D69940BBE6A6B638E9C32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-Verein CA Services

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17887D07675E24
- SHA-256: CE5DF884A9924A9D817B4DBBC619958179F7D8F84DB5C20CA427EE7E2FD0F2DD
- SPKI SHA-256: DFE4E1F515C1D3BE65095C08A64AEEC1DD4D112F514E714B2FE417F42D96E58B
- Validity: 2014-05-06 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6623995040849444 (0x17887d07675e24)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  6 15:27:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein CA Services
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1D:A9:F1:86:26:76:4D:CF:5D:FD:50:A3:6E:EB:F1:BC:22:75:6D:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE5DF884A9924A9D817B4DBBC619958179F7D8F84DB5C20CA427EE7E2FD0F2DD
    SPKI SHA256: DFE4E1F515C1D3BE65095C08A64AEEC1DD4D112F514E714B2FE417F42D96E58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-Verein CA Services

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09BB4B40
- SHA-256: A3470C17A103B0F78596F85C2A3828F1A17A4935206DF895F6C1AA5A954B65C2
- SPKI SHA-256: DFE4E1F515C1D3BE65095C08A64AEEC1DD4D112F514E714B2FE417F42D96E58B
- Validity: 2007-01-03 to 2019-01-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163269440 (0x9bb4b40)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  3 15:37:21 2007 GMT
            Not After : Jan  2 15:37:21 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein CA Services
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1D:A9:F1:86:26:76:4D:CF:5D:FD:50:A3:6E:EB:F1:BC:22:75:6D:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A3470C17A103B0F78596F85C2A3828F1A17A4935206DF895F6C1AA5A954B65C2
    SPKI SHA256: DFE4E1F515C1D3BE65095C08A64AEEC1DD4D112F514E714B2FE417F42D96E58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-Verein CA Services Classic - G01

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein CA Services Classic - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09BB2C77
- SHA-256: 7D73E8AB4F8E04B344D3EFA7514CAEE736E2FEC9F1976E33566D71902077B12B
- SPKI SHA-256: AAAFAA6C4294FD2D17A11F11F8758B7A70117ADADACC83ED52E270049054ED52
- Validity: 2007-01-03 to 2019-01-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163261559 (0x9bb2c77)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  3 13:26:01 2007 GMT
            Not After : Jan  2 13:26:01 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein CA Services Classic - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8E:D2:A7:E9:81:95:86:DC:AB:97:15:D6:48:06:06:14:F6:FD:A8:C4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7D73E8AB4F8E04B344D3EFA7514CAEE736E2FEC9F1976E33566D71902077B12B
    SPKI SHA256: AAAFAA6C4294FD2D17A11F11F8758B7A70117ADADACC83ED52E270049054ED52
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-Verein Certification Authority 2

- Subject: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: E30BD5F8AF25D981
- SHA-256: F660B0C256481CB2BFC67661C1EA8FEEE395B7141BCAC36C36E04D08CD9E1582
- SPKI SHA-256: 9CA0021EB1882BB636462A76E3BBD69CE11F6A917FBFC1FCADEC1DFCCCE56BC5
- Validity: 2016-02-22 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DFN-Verein
- CP/CPS: https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cp_v16-en.pdf, https://doku.tid.dfn.de/_media/de:dfnpki:doc:archiv:dfn-pki_cps_v16-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_Standard_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_TLS-BR_V1.0.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025102801_DFN-Verein_2025_SBR_V1.0.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- CRL DP: http://pki0336.telesec.de/rl/TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e3:0b:d5:f8:af:25:d9:81
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 22 13:38:22 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki0336.telesec.de/rl/TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp0336.telesec.de/ocspr
                CA Issuers - URI:http://pki0336.telesec.de/crt/TeleSec_GlobalRoot_Class_2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F660B0C256481CB2BFC67661C1EA8FEEE395B7141BCAC36C36E04D08CD9E1582
    SPKI SHA256: 9CA0021EB1882BB636462A76E3BBD69CE11F6A917FBFC1FCADEC1DFCCCE56BC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30, 2.23.140.1.2.2
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- AIA CA Issuers: http://pki0336.telesec.de/crt/TeleSec_GlobalRoot_Class_2.cer
- CRL Distribution Points: http://pki0336.telesec.de/rl/TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DFN-Verein Global Issuing CA

- Subject: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Global Issuing CA
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B63BAD01E2C3D
- SHA-256: 1257AAC2F4EEAC6CA4942C2C83F0B67B41A3B47120C4D53429929513ACAD468C
- SPKI SHA-256: DA995610549B8DAE53CF4A4446396BE052F67EBD07E0BE3C46DD19177B0A0444
- Validity: 2016-05-24 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/dfn-ca-global-g2/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7709478377892925 (0x1b63bad01e2c3d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: May 24 11:38:40 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Global Issuing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                6B:3A:98:8B:F9:F2:53:89:DA:E0:AD:B2:32:1E:09:1F:E8:AA:3B:74
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1257AAC2F4EEAC6CA4942C2C83F0B67B41A3B47120C4D53429929513ACAD468C
    SPKI SHA256: DA995610549B8DAE53CF4A4446396BE052F67EBD07E0BE3C46DD19177B0A0444
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DFN-Verein PCA Global - G01

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 504EC6F53D11B464
- SHA-256: 4DBD93C9C8601CB644A8A8830CCDABB368E781EAE48CFD1FF53ECC45F5363981
- SPKI SHA-256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
- Validity: 2014-07-22 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CP.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2018121901_BrowserAttestation_List_s.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/67122UE_s.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.1.1.4.2.2, 1.3.6.1.4.1.22177.300.1.1.4.3.0, 1.3.6.1.4.1.22177.300.1.1.4.3.1, 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- CRL DP: http://pki0336.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5786781327811523684 (0x504ec6f53d11b464)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jul 22 12:08:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.1.1.4.2.2
                Policy: 1.3.6.1.4.1.22177.300.1.1.4.3.0
                Policy: 1.3.6.1.4.1.22177.300.1.1.4.3.1
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
                Policy: 1.3.6.1.4.1.22177.300.30
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki0336.telesec.de/rl/DT_ROOT_CA_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp0336.telesec.de/ocspr
                CA Issuers - URI:http://pki0336.telesec.de/crt/DT_ROOT_CA_2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DBD93C9C8601CB644A8A8830CCDABB368E781EAE48CFD1FF53ECC45F5363981
    SPKI SHA256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.1.1.4.2.2, 1.3.6.1.4.1.22177.300.1.1.4.3.0, 1.3.6.1.4.1.22177.300.1.1.4.3.1, 1.3.6.1.4.1.22177.300.1.1.4, 1.3.6.1.4.1.22177.300.30
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- AIA CA Issuers: http://pki0336.telesec.de/crt/DT_ROOT_CA_2.cer
- CRL Distribution Points: http://pki0336.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-Verein PCA Global - G01

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: C7
- SHA-256: 4D7D83A15BF0AF2C5A23C2631D1613C7A1A5D323BCB8595C24A5649278CD3F1E
- SPKI SHA-256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
- Validity: 2006-12-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CP.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2018121901_BrowserAttestation_List_s.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/67122UE_s.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199 (0xc7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Dec 19 10:29:00 2006 GMT
            Not After : Jun 30 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
            X509v3 Subject Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4D7D83A15BF0AF2C5A23C2631D1613C7A1A5D323BCB8595C24A5649278CD3F1E
    SPKI SHA256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### DFN-Verein PCA Global - G01

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 89901115583E879B
- SHA-256: A8C643939CFB4C8E4E1353562D325BA0DB9EA381271AC60D4C411DBF7F8F3EF0
- SPKI SHA-256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
- Validity: 2014-02-11 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CP.pdf, https://www.pki.dfn.de/fileadmin/PKI/DFN-PKI_CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.pki.dfn.de/ueberblick-dfn-pki/
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- CRL DP: http://ocsp0336.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            89:90:11:15:58:3e:87:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Feb 11 13:11:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ocsp0336.telesec.de/rl/DT_ROOT_CA_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp0336.telesec.de/ocspr
                CA Issuers - URI:http://ocsp0336.telesec.de/crt/DT_ROOT_CA_2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A8C643939CFB4C8E4E1353562D325BA0DB9EA381271AC60D4C411DBF7F8F3EF0
    SPKI SHA256: 5732FE16D00ABF36F83798A0985272BFCDC60FB0812BB632C3E47A5DD4517E68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://ocsp0336.telesec.de/ocspr
- AIA CA Issuers: http://ocsp0336.telesec.de/crt/DT_ROOT_CA_2.cer
- CRL Distribution Points: http://ocsp0336.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-Verein-GS-CA

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09C1C2D7
- SHA-256: AEE68174C0ABB97012655CB504C51D09EBEF26EC63956DB090D8905DF8987F34
- SPKI SHA-256: 0BE26E091E08F0B5051364D37053244799DAC07486C63EE3879B68B094C595DD
- Validity: 2007-01-08 to 2018-11-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163693271 (0x9c1c2d7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  8 13:21:13 2007 GMT
            Not After : Nov 30 22:00:00 2018 GMT
        Subject: C = DE, O = DFN-Verein, OU = Geschaeftsstelle, CN = DFN-Verein-GS-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0A:7D:A5:2C:40:7D:31:05:C3:EF:B2:CB:AE:32:2B:21:D6:D6:43:D2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AEE68174C0ABB97012655CB504C51D09EBEF26EC63956DB090D8905DF8987F34
    SPKI SHA256: 0BE26E091E08F0B5051364D37053244799DAC07486C63EE3879B68B094C595DD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-Verein-GS-CA

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA, emailAddress=ca@dfn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09C2FE10
- SHA-256: 5CAD27C4E7CF1C1F01A0220429402A8104739024E974911155930F26ACB6F4FA
- SPKI SHA-256: 0BE26E091E08F0B5051364D37053244799DAC07486C63EE3879B68B094C595DD
- Validity: 2007-01-09 to 2018-11-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163773968 (0x9c2fe10)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  9 11:46:09 2007 GMT
            Not After : Nov 30 22:00:00 2018 GMT
        Subject: C = DE, O = DFN-Verein, OU = Geschaeftsstelle, CN = DFN-Verein-GS-CA, emailAddress = ca@dfn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0A:7D:A5:2C:40:7D:31:05:C3:EF:B2:CB:AE:32:2B:21:D6:D6:43:D2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5CAD27C4E7CF1C1F01A0220429402A8104739024E974911155930F26ACB6F4FA
    SPKI SHA256: 0BE26E091E08F0B5051364D37053244799DAC07486C63EE3879B68B094C595DD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-Verein-GS-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17887D08B33E3D
- SHA-256: 6773B65E778463E703E7162C56B3EEC953418C6DF604925C5454EAD18C509BC3
- SPKI SHA-256: CEFC4111A698EFAF1F28FDA6F608100EB3DEEEAA26E014FB49CCDE22E0ED18A4
- Validity: 2014-05-06 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6623995062599229 (0x17887d08b33e3d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  6 15:27:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = Geschaeftsstelle, CN = DFN-Verein-GS-CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                79:A2:62:2F:CE:F1:06:39:52:E7:76:6D:62:C7:DE:9B:6A:75:4B:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6773B65E778463E703E7162C56B3EEC953418C6DF604925C5454EAD18C509BC3
    SPKI SHA256: CEFC4111A698EFAF1F28FDA6F608100EB3DEEEAA26E014FB49CCDE22E0ED18A4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-Verein-GS-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=Geschaeftsstelle, commonName=DFN-Verein-GS-CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09CDA572
- SHA-256: 68FCB5A6F656C3EA8825F4E3646C14C0776A76E260E2747385C064FD21901A2B
- SPKI SHA-256: CEFC4111A698EFAF1F28FDA6F608100EB3DEEEAA26E014FB49CCDE22E0ED18A4
- Validity: 2007-01-17 to 2018-11-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 164472178 (0x9cda572)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 17 13:43:00 2007 GMT
            Not After : Nov 30 22:00:00 2018 GMT
        Subject: C = DE, O = DFN-Verein, OU = Geschaeftsstelle, CN = DFN-Verein-GS-CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:A2:62:2F:CE:F1:06:39:52:E7:76:6D:62:C7:DE:9B:6A:75:4B:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 68FCB5A6F656C3EA8825F4E3646C14C0776A76E260E2747385C064FD21901A2B
    SPKI SHA256: CEFC4111A698EFAF1F28FDA6F608100EB3DEEEAA26E014FB49CCDE22E0ED18A4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-WiNShuttle-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca@winshuttle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93DA0
- SHA-256: 4DCF719177654FAEC4A88C768F878A24623C73CEE06256C91019FE630AD01F7E
- SPKI SHA-256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329184 (0x9f93da0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:19:46 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = WiNShuttle, CN = DFN-WiNShuttle-CA - G02, emailAddress = ca@winshuttle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6B:35:F7:93:8C:92:F7:47:12:FC:8B:AD:28:F5:5C:B7:21:67:31:D1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@winshuttle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4DCF719177654FAEC4A88C768F878A24623C73CEE06256C91019FE630AD01F7E
    SPKI SHA256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DFN-WiNShuttle-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca@winshuttle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E82DB7ED
- SHA-256: 7E1EA8767F92D5825F81AEED1E15506941EA77CF123A61E05EF5487C465FE580
- SPKI SHA-256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670350915565 (0x179060e82db7ed)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = WiNShuttle, CN = DFN-WiNShuttle-CA - G02, emailAddress = ca@winshuttle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6B:35:F7:93:8C:92:F7:47:12:FC:8B:AD:28:F5:5C:B7:21:67:31:D1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-winshuttle@dfn.de, email:ca@winshuttle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7E1EA8767F92D5825F81AEED1E15506941EA77CF123A61E05EF5487C465FE580
    SPKI SHA256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-WiNShuttle-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca-winshuttle@dfn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17999FD488BDAD
- SHA-256: F803C80B28190F7D18ECE451A3CC706B3FFD6EDCE1FBD7DF52618F2F60067FAA
- SPKI SHA-256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
- Validity: 2014-05-19 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6642836208926125 (0x17999fd488bdad)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 19 15:24:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = WiNShuttle, CN = DFN-WiNShuttle-CA - G02, emailAddress = ca-winshuttle@dfn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6B:35:F7:93:8C:92:F7:47:12:FC:8B:AD:28:F5:5C:B7:21:67:31:D1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-winshuttle@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F803C80B28190F7D18ECE451A3CC706B3FFD6EDCE1FBD7DF52618F2F60067FAA
    SPKI SHA256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DFN-WiNShuttle-CA - G02

- Subject: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=WiNShuttle, commonName=DFN-WiNShuttle-CA - G02, emailAddress=ca-winshuttle@dfn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F94971
- SHA-256: 632653629EAC3ADB04F10BCFA88F0AB0D58070F93CE4529EAE6986C8AB2221A7
- SPKI SHA-256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167332209 (0x9f94971)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 16:10:11 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, O = DFN-Verein, OU = WiNShuttle, CN = DFN-WiNShuttle-CA - G02, emailAddress = ca-winshuttle@dfn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6B:35:F7:93:8C:92:F7:47:12:FC:8B:AD:28:F5:5C:B7:21:67:31:D1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-winshuttle@dfn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 632653629EAC3ADB04F10BCFA88F0AB0D58070F93CE4529EAE6986C8AB2221A7
    SPKI SHA256: E1361F8B4ED877EDBD1379451C9B47DAAAE51A20B468987265751B593D98C972
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DHBW CA - G01

- Subject: countryName=DE, organizationName=Duale Hochschule Baden-Wuerttemberg, commonName=DHBW CA - G01, emailAddress=pki@dhbw-vs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F9DE6B3
- SHA-256: F185D24771CC88AA4A83683620117C00B3EECBD77CB6B0B595973C773955E101
- SPKI SHA-256: F5D4BE2ACCE1B8647529D7472CBA1A0DB27F9D9A7797969FD2D0284DCCA11D73
- Validity: 2010-02-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 262006451 (0xf9de6b3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 10:34:11 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Duale Hochschule Baden-Wuerttemberg, CN = DHBW CA - G01, emailAddress = pki@dhbw-vs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:E9:70:71:60:B8:53:9F:44:C6:97:5E:42:1F:ED:28:72:BD:0E:7E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dhbw-vs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F185D24771CC88AA4A83683620117C00B3EECBD77CB6B0B595973C773955E101
    SPKI SHA256: F5D4BE2ACCE1B8647529D7472CBA1A0DB27F9D9A7797969FD2D0284DCCA11D73
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DHBW CA - G01

- Subject: countryName=DE, organizationName=Duale Hochschule Baden-Wuerttemberg, commonName=DHBW CA - G01, emailAddress=pki@dhbw-vs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D0362BDA
- SHA-256: 2CA80A62BF6CB9CD93777BE01266B9AD23CAAAA1E599AB620F0EC3A96D21BF0B
- SPKI SHA-256: F5D4BE2ACCE1B8647529D7472CBA1A0DB27F9D9A7797969FD2D0284DCCA11D73
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399054371802 (0x17aff6d0362bda)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Duale Hochschule Baden-Wuerttemberg, CN = DHBW CA - G01, emailAddress = pki@dhbw-vs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:E9:70:71:60:B8:53:9F:44:C6:97:5E:42:1F:ED:28:72:BD:0E:7E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dhbw-vs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2CA80A62BF6CB9CD93777BE01266B9AD23CAAAA1E599AB620F0EC3A96D21BF0B
    SPKI SHA256: F5D4BE2ACCE1B8647529D7472CBA1A0DB27F9D9A7797969FD2D0284DCCA11D73
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DIfE CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Nuthetal, organizationName=Deutsches Institut fuer Ernaehrungsforschung (DIfE), organizationalUnitName=IT, commonName=DIfE CA, emailAddress=ra@dife.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A987064
- SHA-256: C6E14C527E1E2F9B10D0E995F61F1C4A8EB689E4749300AFAC3910D9F60FB423
- SPKI SHA-256: 5D980335C33816CCEF9DB9B3BFF7DEA396ABF0A97E460CA2BB401EB38E0AABA6
- Validity: 2007-06-20 to 2019-06-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177762404 (0xa987064)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 20 09:26:46 2007 GMT
            Not After : Jun 19 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Nuthetal, O = Deutsches Institut fuer Ernaehrungsforschung (DIfE), OU = IT, CN = DIfE CA, emailAddress = ra@dife.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                DC:F7:41:B6:49:1B:40:3E:06:93:C7:67:BD:2D:FA:EA:07:4D:B0:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@dife.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C6E14C527E1E2F9B10D0E995F61F1C4A8EB689E4749300AFAC3910D9F60FB423
    SPKI SHA256: 5D980335C33816CCEF9DB9B3BFF7DEA396ABF0A97E460CA2BB401EB38E0AABA6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DIfE CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Nuthetal, organizationName=Deutsches Institut fuer Ernaehrungsforschung (DIfE), organizationalUnitName=IT, commonName=DIfE CA, emailAddress=ra@dife.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42544ACE536
- SHA-256: 5942C66351E5CC80F0539714549DBA00529ED703888E5F3522A0666AD33A1FC5
- SPKI SHA-256: 5D980335C33816CCEF9DB9B3BFF7DEA396ABF0A97E460CA2BB401EB38E0AABA6
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404437271862 (0x17a42544ace536)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Nuthetal, O = Deutsches Institut fuer Ernaehrungsforschung (DIfE), OU = IT, CN = DIfE CA, emailAddress = ra@dife.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DC:F7:41:B6:49:1B:40:3E:06:93:C7:67:BD:2D:FA:EA:07:4D:B0:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@dife.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5942C66351E5CC80F0539714549DBA00529ED703888E5F3522A0666AD33A1FC5
    SPKI SHA256: 5D980335C33816CCEF9DB9B3BFF7DEA396ABF0A97E460CA2BB401EB38E0AABA6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Difu CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Institut fuer Urbanistik (Difu), commonName=Difu CA, emailAddress=ca@difu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424BF54CC6F
- SHA-256: 61B09C2BB5F42E489EA4913819628C258F4EA4DB3F1896FFE375419E3093284C
- SPKI SHA-256: 944435D1E6081A298EB2D3809C2326CD9B6C49373DCB38AD64EE3FCAFD050603
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402200128623 (0x17a424bf54cc6f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsches Institut fuer Urbanistik (Difu), CN = Difu CA, emailAddress = ca@difu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CB:49:40:46:BE:E1:19:F0:94:8D:92:2A:C8:D5:84:D4:D9:9F:DA:98
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@difu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 61B09C2BB5F42E489EA4913819628C258F4EA4DB3F1896FFE375419E3093284C
    SPKI SHA256: 944435D1E6081A298EB2D3809C2326CD9B6C49373DCB38AD64EE3FCAFD050603
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Difu CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Deutsches Institut fuer Urbanistik (Difu), commonName=Difu CA, emailAddress=ca@difu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C79A663
- SHA-256: 32093CAFAC7B6444F31F29698150ED3D5875228D8F43A3079AC700877EB623E9
- SPKI SHA-256: 944435D1E6081A298EB2D3809C2326CD9B6C49373DCB38AD64EE3FCAFD050603
- Validity: 2008-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 209299043 (0xc79a663)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:37:24 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Deutsches Institut fuer Urbanistik (Difu), CN = Difu CA, emailAddress = ca@difu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CB:49:40:46:BE:E1:19:F0:94:8D:92:2A:C8:D5:84:D4:D9:9F:DA:98
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@difu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 32093CAFAC7B6444F31F29698150ED3D5875228D8F43A3079AC700877EB623E9
    SPKI SHA256: 944435D1E6081A298EB2D3809C2326CD9B6C49373DCB38AD64EE3FCAFD050603
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DIMDI CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Deutsches Institut f. Medizinische Dokumentation und Information, commonName=DIMDI CA - G01, emailAddress=ca@dimdi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1930BAC90BD94F
- SHA-256: 0603CB337563B15077BF50F22CD2CFE2B3E1412FD2118ED27F22C600ED9D6AF9
- SPKI SHA-256: A3B82D9CBDB5651511849AC02A3A6E442D13EEF9288C5BAF7445D94A11BDCF8C
- Validity: 2015-03-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7090453212813647 (0x1930bac90bd94f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 24 10:32:25 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Deutsches Institut f. Medizinische Dokumentation und Information, CN = DIMDI CA - G01, emailAddress = ca@dimdi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                34:4C:63:8A:73:79:3A:B8:F8:95:F9:79:51:C7:B8:77:57:75:3F:F4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dimdi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0603CB337563B15077BF50F22CD2CFE2B3E1412FD2118ED27F22C600ED9D6AF9
    SPKI SHA256: A3B82D9CBDB5651511849AC02A3A6E442D13EEF9288C5BAF7445D94A11BDCF8C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DIPF CA - G02

- Subject: countryName=DE, organizationName=Deutsches Institut fuer Internationale Paedagogische Forschung, commonName=DIPF CA - G02, emailAddress=ca@dipf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BA56EFA
- SHA-256: 26542A7957692575FE1951D4EB850DDAD12864CFA3C9119D2BA46AD0A7C3E37F
- SPKI SHA-256: 6B92902C94D9123A4ACCCDAA55114555A3B2E219E5D69AEE1549F8951456EA80
- Validity: 2008-01-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 195391226 (0xba56efa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 10 10:20:27 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Institut fuer Internationale Paedagogische Forschung, CN = DIPF CA - G02, emailAddress = ca@dipf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4D:4C:8E:FE:26:EF:65:7D:90:88:8D:1D:1A:5F:2F:9A:67:02:6E:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dipf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 26542A7957692575FE1951D4EB850DDAD12864CFA3C9119D2BA46AD0A7C3E37F
    SPKI SHA256: 6B92902C94D9123A4ACCCDAA55114555A3B2E219E5D69AEE1549F8951456EA80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DIPF CA - G02

- Subject: countryName=DE, organizationName=Deutsches Institut fuer Internationale Paedagogische Forschung, commonName=DIPF CA - G02, emailAddress=ca@dipf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A36CBF96
- SHA-256: 63EE825D778B9E95392F160D4CA99B5D8030A675314A169854CDC1410F92F7D1
- SPKI SHA-256: 6B92902C94D9123A4ACCCDAA55114555A3B2E219E5D69AEE1549F8951456EA80
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401731936150 (0x17a424a36cbf96)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsches Institut fuer Internationale Paedagogische Forschung, CN = DIPF CA - G02, emailAddress = ca@dipf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4D:4C:8E:FE:26:EF:65:7D:90:88:8D:1D:1A:5F:2F:9A:67:02:6E:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dipf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 63EE825D778B9E95392F160D4CA99B5D8030A675314A169854CDC1410F92F7D1
    SPKI SHA256: 6B92902C94D9123A4ACCCDAA55114555A3B2E219E5D69AEE1549F8951456EA80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DIW Berlin CA

- Subject: countryName=DE, organizationName=Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), organizationalUnitName=IT, commonName=DIW Berlin CA, emailAddress=diw-ca@diw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A8E30F38
- SHA-256: 8184C4682BD4570A11AAF540923E89C25C34C945D41E89C55214B3378729694B
- SPKI SHA-256: 907115E16088C98D050B23B16F514A727391AE224479C92E9462C0187465A50B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398394613560 (0x17aff6a8e30f38)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:13 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), OU = IT, CN = DIW Berlin CA, emailAddress = diw-ca@diw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EF:BF:F2:E4:CD:D5:94:82:C0:30:1A:64:38:C4:02:E6:3A:8C:5B:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:diw-ca@diw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8184C4682BD4570A11AAF540923E89C25C34C945D41E89C55214B3378729694B
    SPKI SHA256: 907115E16088C98D050B23B16F514A727391AE224479C92E9462C0187465A50B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DIW Berlin CA

- Subject: countryName=DE, organizationName=Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), organizationalUnitName=IT, commonName=DIW Berlin CA, emailAddress=diw-ca@diw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DE9AA43
- SHA-256: 1E615D1E11808A159F1CC5989265FE308F2E1C067E452C52202A9DC10EC9D9E3
- SPKI SHA-256: 907115E16088C98D050B23B16F514A727391AE224479C92E9462C0187465A50B
- Validity: 2009-03-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 233417283 (0xde9aa43)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 25 13:08:04 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Institut fuer Wirtschaftsforschung e.V. (DIW Berlin), OU = IT, CN = DIW Berlin CA, emailAddress = diw-ca@diw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EF:BF:F2:E4:CD:D5:94:82:C0:30:1A:64:38:C4:02:E6:3A:8C:5B:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:diw-ca@diw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1E615D1E11808A159F1CC5989265FE308F2E1C067E452C52202A9DC10EC9D9E3
    SPKI SHA256: 907115E16088C98D050B23B16F514A727391AE224479C92E9462C0187465A50B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DKFZ CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906110D3DF57
- SHA-256: CAB6DC247C25036EDA2AC02231762E3F5DE91F5ADB0F7EE7CC5D9030C602817A
- SPKI SHA-256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671032893271 (0x17906110d3df57)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Deutsches Krebsforschungszentrum (DKFZ), OU = ZDV, CN = DKFZ CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6A:4B:E1:9B:13:A0:7F:CA:74:FA:31:D4:68:6E:2B:9A:6B:4C:39:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dfnpki@dkfz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CAB6DC247C25036EDA2AC02231762E3F5DE91F5ADB0F7EE7CC5D9030C602817A
    SPKI SHA256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DKFZ CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA, emailAddress=dfnpki@dkfz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1799A015494F28
- SHA-256: 82C91F92559CDA5E3FCC834BB0412656108AE67D0C77F045C8D4C185EA9EDF76
- SPKI SHA-256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
- Validity: 2014-05-19 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6642837295288104 (0x1799a015494f28)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 19 15:25:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Deutsches Krebsforschungszentrum (DKFZ), OU = ZDV, CN = DKFZ CA, emailAddress = dfnpki@dkfz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6A:4B:E1:9B:13:A0:7F:CA:74:FA:31:D4:68:6E:2B:9A:6B:4C:39:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dfnpki@dkfz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 82C91F92559CDA5E3FCC834BB0412656108AE67D0C77F045C8D4C185EA9EDF76
    SPKI SHA256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DKFZ CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Deutsches Krebsforschungszentrum (DKFZ), organizationalUnitName=ZDV, commonName=DKFZ CA, emailAddress=dfnpki@dkfz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A3C0CB9
- SHA-256: 63B30F3CF611934AAA4A88F0A00C837C63FF455E86F1388674471121CA465F2B
- SPKI SHA-256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
- Validity: 2007-04-11 to 2019-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171707577 (0xa3c0cb9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 07:32:59 2007 GMT
            Not After : Apr  9 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Deutsches Krebsforschungszentrum (DKFZ), OU = ZDV, CN = DKFZ CA, emailAddress = dfnpki@dkfz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6A:4B:E1:9B:13:A0:7F:CA:74:FA:31:D4:68:6E:2B:9A:6B:4C:39:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dfnpki@dkfz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 63B30F3CF611934AAA4A88F0A00C837C63FF455E86F1388674471121CA465F2B
    SPKI SHA256: 24A3637FE4C3DBADFA89CE3597EE4E5EB063E45EC9DB27E4A86F22A16513685A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DKRZ CA - G02

- Subject: countryName=DE, organizationName=Deutsches Klimarechenzentrum GmbH, commonName=DKRZ CA - G02, emailAddress=pki@dkrz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB179
- SHA-256: 90F89AC167CC4932C97EF57F1BAF38CDACE3F6A731D3C33A4E4794AFE66710EC
- SPKI SHA-256: B936707EE3B31420D1386CA6F0314E656EA3DD18FC3B9F0C9DB5F34BF5C23198
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604025 (0xa0cb179)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:06 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Klimarechenzentrum GmbH, CN = DKRZ CA - G02, emailAddress = pki@dkrz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:33:E8:3A:23:1D:39:2E:5E:E0:05:A2:09:59:29:48:2D:EC:E6:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dkrz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 90F89AC167CC4932C97EF57F1BAF38CDACE3F6A731D3C33A4E4794AFE66710EC
    SPKI SHA256: B936707EE3B31420D1386CA6F0314E656EA3DD18FC3B9F0C9DB5F34BF5C23198
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DKRZ CA - G02

- Subject: countryName=DE, organizationName=Deutsches Klimarechenzentrum GmbH, commonName=DKRZ CA - G02, emailAddress=pki@dkrz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060ED96115A
- SHA-256: 9FEEABEA2EDF31A5BCC84D14D83D2728EEAB5CF6E6AAEB6192FC78A86AB3DB10
- SPKI SHA-256: B936707EE3B31420D1386CA6F0314E656EA3DD18FC3B9F0C9DB5F34BF5C23198
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670441640282 (0x179060ed96115a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:05 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Deutsches Klimarechenzentrum GmbH, CN = DKRZ CA - G02, emailAddress = pki@dkrz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AB:33:E8:3A:23:1D:39:2E:5E:E0:05:A2:09:59:29:48:2D:EC:E6:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dkrz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9FEEABEA2EDF31A5BCC84D14D83D2728EEAB5CF6E6AAEB6192FC78A86AB3DB10
    SPKI SHA256: B936707EE3B31420D1386CA6F0314E656EA3DD18FC3B9F0C9DB5F34BF5C23198
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DLA Marbach CA - G01

- Subject: countryName=DE, organizationName=Deutsche Schillergesellschaft e. V., organizationalUnitName=Deutsches Literaturarchiv Marbach, commonName=DLA Marbach CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94E470CADA
- SHA-256: 903D259EF9E252FDDF55DC2CCBAE325DD7EA08A528B028B37D77C1BA578BE7B1
- SPKI SHA-256: 57FE02DD661F8E66E9C592DA2FFE1BA053DBDD11E7C9A9BC1BF43446AE47A30D
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612002905574106 (0x177d94e470cada)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:45 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsche Schillergesellschaft e. V., OU = Deutsches Literaturarchiv Marbach, CN = DLA Marbach CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                63:12:55:E9:F6:22:03:02:A6:6D:41:0D:DE:27:A0:0A:78:26:69:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 903D259EF9E252FDDF55DC2CCBAE325DD7EA08A528B028B37D77C1BA578BE7B1
    SPKI SHA256: 57FE02DD661F8E66E9C592DA2FFE1BA053DBDD11E7C9A9BC1BF43446AE47A30D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DLR CA - G02

- Subject: countryName=DE, organizationName=Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), commonName=DLR CA - G02, emailAddress=ca@dlr.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181E9017E32B0A
- SHA-256: 2A17DEA7F2587F2F842EAA96C789EE86F38DCC0E618645EBF81BFF54C71309EF
- SPKI SHA-256: 223727F691A7A92647314B90E77F603A19B35C2FA85F46A3C5BA1A77E86D433D
- Validity: 2014-08-28 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6789003665943306 (0x181e9017e32b0a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 28 11:29:11 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), CN = DLR CA - G02, emailAddress = ca@dlr.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                66:A2:A5:F3:45:3D:BE:94:77:33:2D:30:9B:21:28:F7:FC:0C:1D:B5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dlr.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2A17DEA7F2587F2F842EAA96C789EE86F38DCC0E618645EBF81BFF54C71309EF
    SPKI SHA256: 223727F691A7A92647314B90E77F603A19B35C2FA85F46A3C5BA1A77E86D433D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DLR CA - G02

- Subject: countryName=DE, organizationName=Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), commonName=DLR CA - G02, emailAddress=ca@dlr.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DFDDCE
- SHA-256: CBA0E9BB54008E01E3CDE9A48AC8DD44AE924926389D27F54898E9BE13AA044F
- SPKI SHA-256: 223727F691A7A92647314B90E77F603A19B35C2FA85F46A3C5BA1A77E86D433D
- Validity: 2007-01-31 to 2019-01-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165666254 (0x9dfddce)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 31 09:24:16 2007 GMT
            Not After : Jan 30 00:00:00 2019 GMT
        Subject: C = DE, O = Deutsches Zentrum fuer Luft- und Raumfahrt e.V. (DLR), CN = DLR CA - G02, emailAddress = ca@dlr.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                66:A2:A5:F3:45:3D:BE:94:77:33:2D:30:9B:21:28:F7:FC:0C:1D:B5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dlr.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CBA0E9BB54008E01E3CDE9A48AC8DD44AE924926389D27F54898E9BE13AA044F
    SPKI SHA256: 223727F691A7A92647314B90E77F603A19B35C2FA85F46A3C5BA1A77E86D433D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DNB-CA

- Subject: countryName=DE, localityName=Frankfurt am Main, organizationName=Deutsche Nationalbibliothek, commonName=DNB-CA, emailAddress=ca@d-nb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424FF4D00C4
- SHA-256: 9670E3C2426CFF81B793BD13DFFE18AEAE6BDA38E6C111DA1D7B9BBF6C349B35
- SPKI SHA-256: A09572C859B97456FC04BA7062F402D9D0B8878A27BBD5B4049D24BFB58A6E6F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403273359556 (0x17a424ff4d00c4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Frankfurt am Main, O = Deutsche Nationalbibliothek, CN = DNB-CA, emailAddress = ca@d-nb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E1:54:80:59:BA:93:83:7F:C2:8A:CE:81:67:1C:21:D1:B9:AE:D6:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@d-nb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9670E3C2426CFF81B793BD13DFFE18AEAE6BDA38E6C111DA1D7B9BBF6C349B35
    SPKI SHA256: A09572C859B97456FC04BA7062F402D9D0B8878A27BBD5B4049D24BFB58A6E6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DNB-CA

- Subject: countryName=DE, localityName=Frankfurt am Main, organizationName=Deutsche Nationalbibliothek, commonName=DNB-CA, emailAddress=ca@d-nb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B5A5FF2
- SHA-256: D1281B67DF894A39A8D8D402741510D0E9751E802AA96D3B3FA5DD1E355FD877
- SPKI SHA-256: A09572C859B97456FC04BA7062F402D9D0B8878A27BBD5B4049D24BFB58A6E6F
- Validity: 2007-11-14 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 190472178 (0xb5a5ff2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 14 11:56:20 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Frankfurt am Main, O = Deutsche Nationalbibliothek, CN = DNB-CA, emailAddress = ca@d-nb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E1:54:80:59:BA:93:83:7F:C2:8A:CE:81:67:1C:21:D1:B9:AE:D6:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@d-nb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D1281B67DF894A39A8D8D402741510D0E9751E802AA96D3B3FA5DD1E355FD877
    SPKI SHA256: A09572C859B97456FC04BA7062F402D9D0B8878A27BBD5B4049D24BFB58A6E6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DRS CA - G01

- Subject: countryName=DE, organizationName=Dioezese Rottenburg-Stuttgart, commonName=DRS CA - G01, emailAddress=pki@drs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CCDF89F
- SHA-256: A2F59C4448E956C8EDE884B53B3C9EC2CB02458BB08097AF81EBBA7E791D506E
- SPKI SHA-256: 19081732AACA1DE4C93B00237AD172C38E169C594842A155431933F34618F447
- Validity: 2008-08-22 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 214825119 (0xccdf89f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 22 08:38:39 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Dioezese Rottenburg-Stuttgart, CN = DRS CA - G01, emailAddress = pki@drs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BC:14:E9:1A:AC:26:D8:E0:49:4E:34:D6:65:9F:96:B1:66:AD:88:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@drs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A2F59C4448E956C8EDE884B53B3C9EC2CB02458BB08097AF81EBBA7E791D506E
    SPKI SHA256: 19081732AACA1DE4C93B00237AD172C38E169C594842A155431933F34618F447
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DRS CA - G01

- Subject: countryName=DE, organizationName=Dioezese Rottenburg-Stuttgart, commonName=DRS CA - G01, emailAddress=pki@drs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6906E6E14
- SHA-256: D01B27BF085AA159FC847819340F39C8E6FAE24AD06D4569E18C9EC100337DDA
- SPKI SHA-256: 19081732AACA1DE4C93B00237AD172C38E169C594842A155431933F34618F447
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667397984316948 (0x17aff6906e6e14)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:49 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Dioezese Rottenburg-Stuttgart, CN = DRS CA - G01, emailAddress = pki@drs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BC:14:E9:1A:AC:26:D8:E0:49:4E:34:D6:65:9F:96:B1:66:AD:88:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@drs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D01B27BF085AA159FC847819340F39C8E6FAE24AD06D4569E18C9EC100337DDA
    SPKI SHA256: 19081732AACA1DE4C93B00237AD172C38E169C594842A155431933F34618F447
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### EAH-CA - G01

- Subject: countryName=DE, organizationName=Ernst-Abbe-Hochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=EAH-CA - G01, emailAddress=pki@eah-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 18A67742F114EA
- SHA-256: BC67DB0F619C4A761BC40B66D58BE05D0C856633F1358529C11C4EA01E1039C3
- SPKI SHA-256: 2F08CC6A2DEF4C7CED1F89E4D7E164D2AB7D542785F0793A5187DC6438EC87B1
- Validity: 2014-12-09 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6938430595470570 (0x18a67742f114ea)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  9 13:31:30 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, O = Ernst-Abbe-Hochschule Jena, OU = ServiceZentrum Informatik, CN = EAH-CA - G01, emailAddress = pki@eah-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                8A:75:82:80:DD:E1:9A:7D:9F:0A:28:2B:F7:BB:53:2D:A7:42:4A:AE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@eah-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC67DB0F619C4A761BC40B66D58BE05D0C856633F1358529C11C4EA01E1039C3
    SPKI SHA256: 2F08CC6A2DEF4C7CED1F89E4D7E164D2AB7D542785F0793A5187DC6438EC87B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ernst Moritz Arndt Universitaet Greifswald - G02

- Subject: countryName=DE, organizationName=Universitaet Greifswald, organizationalUnitName=Rechenzentrum, commonName=Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress=ugca@uni-greifswald.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E2E5E678
- SHA-256: CC502AE8B20F131DB9E66B5A8979EA31A57FEC062CB9F7B3ACEF0915E116D9F8
- SPKI SHA-256: ED2EEB029A0A906D1A726D26C878E816E9675D6DF668C1B1BC14A86C1988F3F7
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670262322808 (0x179060e2e5e678)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Greifswald, OU = Rechenzentrum, CN = Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress = ugca@uni-greifswald.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                30:F6:BF:42:3B:B8:05:68:56:F2:0C:54:3C:9C:10:54:B8:5E:F8:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ugca@uni-greifswald.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC502AE8B20F131DB9E66B5A8979EA31A57FEC062CB9F7B3ACEF0915E116D9F8
    SPKI SHA256: ED2EEB029A0A906D1A726D26C878E816E9675D6DF668C1B1BC14A86C1988F3F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ernst Moritz Arndt Universitaet Greifswald - G02

- Subject: countryName=DE, organizationName=Universitaet Greifswald, organizationalUnitName=Rechenzentrum, commonName=Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress=ugca@uni-greifswald.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F274EC
- SHA-256: 912D9EFB5E7B4A293315EE55BFB5D4EC8F78979310BA29CA78E3A41C4E9DD01E
- SPKI SHA-256: ED2EEB029A0A906D1A726D26C878E816E9675D6DF668C1B1BC14A86C1988F3F7
- Validity: 2007-02-14 to 2019-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166884588 (0x9f274ec)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 14 11:49:50 2007 GMT
            Not After : Feb 13 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Greifswald, OU = Rechenzentrum, CN = Ernst Moritz Arndt Universitaet Greifswald - G02, emailAddress = ugca@uni-greifswald.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                30:F6:BF:42:3B:B8:05:68:56:F2:0C:54:3C:9C:10:54:B8:5E:F8:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ugca@uni-greifswald.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 912D9EFB5E7B4A293315EE55BFB5D4EC8F78979310BA29CA78E3A41C4E9DD01E
    SPKI SHA256: ED2EEB029A0A906D1A726D26C878E816E9675D6DF668C1B1BC14A86C1988F3F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ESO PKI - G02

- Subject: countryName=DE, organizationName=ESO - European Organisation for Astronomical Research, organizationalUnitName=TEC, commonName=ESO PKI - G02, emailAddress=trustmaster@eso.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DD666E
- SHA-256: ECDDFD8A1C979FEC9C75326711C45284F3C7C42EC0FE5309B93C3543B1C05B8C
- SPKI SHA-256: B7F01F332423CC870654DB697A7EE70709E6B5D4200C4DFFC95DB03771786864
- Validity: 2007-01-29 to 2019-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165504622 (0x9dd666e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 29 12:30:23 2007 GMT
            Not After : Jan 28 00:00:00 2019 GMT
        Subject: C = DE, O = ESO - European Organisation for Astronomical Research, OU = TEC, CN = ESO PKI - G02, emailAddress = trustmaster@eso.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:1E:77:34:DE:79:01:B2:E6:4E:1B:26:E2:9B:77:89:D8:39:BE:7D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:trustmaster@eso.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: ECDDFD8A1C979FEC9C75326711C45284F3C7C42EC0FE5309B93C3543B1C05B8C
    SPKI SHA256: B7F01F332423CC870654DB697A7EE70709E6B5D4200C4DFFC95DB03771786864
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ESO PKI - G02

- Subject: countryName=DE, organizationName=ESO - European Organisation for Astronomical Research, organizationalUnitName=TEC, commonName=ESO PKI - G02, emailAddress=trustmaster@eso.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060CF51D115
- SHA-256: 8FA5BFD4ED0EC08CB1DDDE47D1D891649A44DFA7E5989E422000AEA7CA4920CC
- SPKI SHA-256: B7F01F332423CC870654DB697A7EE70709E6B5D4200C4DFFC95DB03771786864
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669933850901 (0x179060cf51d115)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = ESO - European Organisation for Astronomical Research, OU = TEC, CN = ESO PKI - G02, emailAddress = trustmaster@eso.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B1:1E:77:34:DE:79:01:B2:E6:4E:1B:26:E2:9B:77:89:D8:39:BE:7D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:trustmaster@eso.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8FA5BFD4ED0EC08CB1DDDE47D1D891649A44DFA7E5989E422000AEA7CA4920CC
    SPKI SHA256: B7F01F332423CC870654DB697A7EE70709E6B5D4200C4DFFC95DB03771786864
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Europa-Universitaet Viadrina CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Frankfurt (Oder), organizationName=Europa-Universitaet Viadrina Frankfurt (Oder), commonName=Europa-Universitaet Viadrina CA, emailAddress=pki@europa-uni.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10511FE5
- SHA-256: 279064566321C879FCF00704F0E80BB01498DF1F2E4A0529749E9FBD76860950
- SPKI SHA-256: EA808A0D85C51825F1585975B55DE477C70C052EFF9DAB1538B73C66EEE0AE72
- Validity: 2010-07-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 273752037 (0x10511fe5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  5 09:13:57 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Frankfurt (Oder), O = Europa-Universitaet Viadrina Frankfurt (Oder), CN = Europa-Universitaet Viadrina CA, emailAddress = pki@europa-uni.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C8:7A:EE:90:45:9F:B6:05:4A:8D:0E:FE:75:7E:18:6D:9C:6B:56:27
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@europa-uni.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 279064566321C879FCF00704F0E80BB01498DF1F2E4A0529749E9FBD76860950
    SPKI SHA256: EA808A0D85C51825F1585975B55DE477C70C052EFF9DAB1538B73C66EEE0AE72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Europa-Universitaet Viadrina CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Frankfurt (Oder), organizationName=Europa-Universitaet Viadrina Frankfurt (Oder), commonName=Europa-Universitaet Viadrina CA, emailAddress=pki@europa-uni.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E037A696
- SHA-256: B2F259E386771945CA7EB8F607335B5DE9C8A76FC65138E9843D8A18BCEF0AAE
- SPKI SHA-256: EA808A0D85C51825F1585975B55DE477C70C052EFF9DAB1538B73C66EEE0AE72
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399322904214 (0x17aff6e037a696)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Frankfurt (Oder), O = Europa-Universitaet Viadrina Frankfurt (Oder), CN = Europa-Universitaet Viadrina CA, emailAddress = pki@europa-uni.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C8:7A:EE:90:45:9F:B6:05:4A:8D:0E:FE:75:7E:18:6D:9C:6B:56:27
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@europa-uni.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B2F259E386771945CA7EB8F607335B5DE9C8A76FC65138E9843D8A18BCEF0AAE
    SPKI SHA256: EA808A0D85C51825F1585975B55DE477C70C052EFF9DAB1538B73C66EEE0AE72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Evangelische Fachhochschule RWL CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Evangelische Fachhochschule Rheinland-Westfalen-Lippe, organizationalUnitName=HRZ, commonName=Evangelische Fachhochschule RWL CA - G01, emailAddress=pki@efh-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6AC3B0C51
- SHA-256: 835E8875A4918A954E755E9AB8E248F7CE8A180150AB5579B6D9BC69E7B84359
- SPKI SHA-256: F701A8BC6BB67AC79F6D4B7D53536FE09FE78D93BEAC1E53FC1BF3233BE97E57
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398450711633 (0x17aff6ac3b0c51)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:16 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Evangelische Fachhochschule Rheinland-Westfalen-Lippe, OU = HRZ, CN = Evangelische Fachhochschule RWL CA - G01, emailAddress = pki@efh-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                35:2C:54:44:98:D4:5D:22:0D:47:BE:FA:30:F7:AC:0F:14:11:A6:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@efh-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 835E8875A4918A954E755E9AB8E248F7CE8A180150AB5579B6D9BC69E7B84359
    SPKI SHA256: F701A8BC6BB67AC79F6D4B7D53536FE09FE78D93BEAC1E53FC1BF3233BE97E57
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Evangelische Fachhochschule RWL CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Evangelische Fachhochschule Rheinland-Westfalen-Lippe, organizationalUnitName=HRZ, commonName=Evangelische Fachhochschule RWL CA - G01, emailAddress=pki@efh-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DFC1274
- SHA-256: 805AEB940EF383753A98CF5F7E4B4B54C26A75B295E28B5BD7AE37FC24718709
- SPKI SHA-256: F701A8BC6BB67AC79F6D4B7D53536FE09FE78D93BEAC1E53FC1BF3233BE97E57
- Validity: 2009-04-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 234623604 (0xdfc1274)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  8 12:13:25 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Evangelische Fachhochschule Rheinland-Westfalen-Lippe, OU = HRZ, CN = Evangelische Fachhochschule RWL CA - G01, emailAddress = pki@efh-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                35:2C:54:44:98:D4:5D:22:0D:47:BE:FA:30:F7:AC:0F:14:11:A6:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@efh-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 805AEB940EF383753A98CF5F7E4B4B54C26A75B295E28B5BD7AE37FC24718709
    SPKI SHA256: F701A8BC6BB67AC79F6D4B7D53536FE09FE78D93BEAC1E53FC1BF3233BE97E57
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### EVHN CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Nuernberg, organizationName=Evangelische Hochschule Nuernberg, commonName=EVHN CA - G01, emailAddress=ca@evhn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17DF58A65CFDA9
- SHA-256: B66E0AF577C328D4596136463CBC7A4DC1F0789EC532F7CBF10E7ABCAF7CB093
- SPKI SHA-256: 2567F7E85AF7888D263C41C59A40C7C8F83EA738F1E4805315232CC13F05D74B
- Validity: 2014-07-11 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6719496305573289 (0x17df58a65cfda9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 11 12:39:50 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Nuernberg, O = Evangelische Hochschule Nuernberg, CN = EVHN CA - G01, emailAddress = ca@evhn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9B:69:C7:ED:44:86:17:C3:1C:9E:95:01:F3:11:84:38:08:B7:86:10
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@evhn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B66E0AF577C328D4596136463CBC7A4DC1F0789EC532F7CBF10E7ABCAF7CB093
    SPKI SHA256: 2567F7E85AF7888D263C41C59A40C7C8F83EA738F1E4805315232CC13F05D74B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FA Ludwigsburg CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Filmakademie Baden-Wuerttemberg GmbH, organizationalUnitName=IT OfficeNet, commonName=FA Ludwigsburg CA, emailAddress=ca-falu@filmakademie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DC3675BB
- SHA-256: BB39F5FE4CDD61EBF90813BB87329060B81315B25FD40D1094BCF067A912852E
- SPKI SHA-256: 1FE46391413390ED1C550DE6812D45986AD815D29013E6D8C2A25BDB6B022424
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399255717307 (0x17aff6dc3675bb)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:04 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ludwigsburg, O = Filmakademie Baden-Wuerttemberg GmbH, OU = IT OfficeNet, CN = FA Ludwigsburg CA, emailAddress = ca-falu@filmakademie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CD:EE:47:12:72:3D:E2:8D:79:5B:AC:DE:23:4B:7D:06:70:58:98:BC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-falu@filmakademie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB39F5FE4CDD61EBF90813BB87329060B81315B25FD40D1094BCF067A912852E
    SPKI SHA256: 1FE46391413390ED1C550DE6812D45986AD815D29013E6D8C2A25BDB6B022424
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FA Ludwigsburg CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Filmakademie Baden-Wuerttemberg GmbH, organizationalUnitName=IT OfficeNet, commonName=FA Ludwigsburg CA, emailAddress=ca-falu@filmakademie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 101B4E02
- SHA-256: 7A9875F1282314F4AC4426A8385ADF5E1D376FADEA164812F90D3068CBDC9F44
- SPKI SHA-256: 1FE46391413390ED1C550DE6812D45986AD815D29013E6D8C2A25BDB6B022424
- Validity: 2010-05-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 270224898 (0x101b4e02)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 25 13:28:19 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ludwigsburg, O = Filmakademie Baden-Wuerttemberg GmbH, OU = IT OfficeNet, CN = FA Ludwigsburg CA, emailAddress = ca-falu@filmakademie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CD:EE:47:12:72:3D:E2:8D:79:5B:AC:DE:23:4B:7D:06:70:58:98:BC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-falu@filmakademie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7A9875F1282314F4AC4426A8385ADF5E1D376FADEA164812F90D3068CBDC9F44
    SPKI SHA256: 1FE46391413390ED1C550DE6812D45986AD815D29013E6D8C2A25BDB6B022424
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Aachen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Aachen, organizationName=Fachhochschule Aachen, organizationalUnitName=DVZ, commonName=Fachhochschule Aachen CA - G01, emailAddress=PKI@fh-aachen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C3014D5
- SHA-256: 5F9FC34D51C2A90312108B29438B14E50E15F370B70FB6A40C8413363A911FFF
- SPKI SHA-256: 4123CAA0D3B5A0D301B1800F6356EFF8F2E9D2C45B2E8BDA0CE9248ED55C9774
- Validity: 2008-04-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 204477653 (0xc3014d5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 24 14:20:54 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Aachen, O = Fachhochschule Aachen, OU = DVZ, CN = Fachhochschule Aachen CA - G01, emailAddress = PKI@fh-aachen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E7:FE:9E:7F:95:4F:E7:A3:2E:F9:08:75:07:DE:10:BA:0D:6A:85:0C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:PKI@fh-aachen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5F9FC34D51C2A90312108B29438B14E50E15F370B70FB6A40C8413363A911FFF
    SPKI SHA256: 4123CAA0D3B5A0D301B1800F6356EFF8F2E9D2C45B2E8BDA0CE9248ED55C9774
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Aachen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Aachen, organizationName=Fachhochschule Aachen, organizationalUnitName=DVZ, commonName=Fachhochschule Aachen CA - G01, emailAddress=PKI@fh-aachen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424BC4B6C59
- SHA-256: 6B4590B5B3D438A95B1D02B68456716066B1395B1268F9148126F2FE56FDD50A
- SPKI SHA-256: 4123CAA0D3B5A0D301B1800F6356EFF8F2E9D2C45B2E8BDA0CE9248ED55C9774
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402149182553 (0x17a424bc4b6c59)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Aachen, O = Fachhochschule Aachen, OU = DVZ, CN = Fachhochschule Aachen CA - G01, emailAddress = PKI@fh-aachen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E7:FE:9E:7F:95:4F:E7:A3:2E:F9:08:75:07:DE:10:BA:0D:6A:85:0C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:PKI@fh-aachen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6B4590B5B3D438A95B1D02B68456716066B1395B1268F9148126F2FE56FDD50A
    SPKI SHA256: 4123CAA0D3B5A0D301B1800F6356EFF8F2E9D2C45B2E8BDA0CE9248ED55C9774
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Aschaffenburg

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Aschaffenburg, organizationName=Fachhochschule Aschaffenburg, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Aschaffenburg, emailAddress=pki2@fh-aschaffenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249830F62A
- SHA-256: 8501D5CF9C6E8FE812EFD074507630BD2D57907C5C8B636ACD59C50A41054E65
- SPKI SHA-256: 447CA693DE1354AA987E7EA18E059B6F6CB052832A3FAD153046F07A29FD444D
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401543468586 (0x17a4249830f62a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Aschaffenburg, O = Fachhochschule Aschaffenburg, OU = Rechenzentrum, CN = Fachhochschule Aschaffenburg, emailAddress = pki2@fh-aschaffenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                93:04:5E:3B:C2:59:7E:B5:46:B6:45:73:2A:BA:7F:55:F6:FB:85:2F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki2@fh-aschaffenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8501D5CF9C6E8FE812EFD074507630BD2D57907C5C8B636ACD59C50A41054E65
    SPKI SHA256: 447CA693DE1354AA987E7EA18E059B6F6CB052832A3FAD153046F07A29FD444D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Aschaffenburg

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Aschaffenburg, organizationName=Fachhochschule Aschaffenburg, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Aschaffenburg, emailAddress=pki2@fh-aschaffenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B73522C
- SHA-256: E21A16C9CFEF195E5BD960FC0697F4BEB2B44EBE3172DCD9A61E7C6E341CC897
- SPKI SHA-256: 447CA693DE1354AA987E7EA18E059B6F6CB052832A3FAD153046F07A29FD444D
- Validity: 2007-12-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 192107052 (0xb73522c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  3 10:04:13 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Aschaffenburg, O = Fachhochschule Aschaffenburg, OU = Rechenzentrum, CN = Fachhochschule Aschaffenburg, emailAddress = pki2@fh-aschaffenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                93:04:5E:3B:C2:59:7E:B5:46:B6:45:73:2A:BA:7F:55:F6:FB:85:2F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki2@fh-aschaffenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E21A16C9CFEF195E5BD960FC0697F4BEB2B44EBE3172DCD9A61E7C6E341CC897
    SPKI SHA256: 447CA693DE1354AA987E7EA18E059B6F6CB052832A3FAD153046F07A29FD444D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Bielefeld

- Subject: countryName=DE, organizationName=Fachhochschule Bielefeld, commonName=Fachhochschule Bielefeld
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09D7EE37
- SHA-256: DD703F92AA2B4A596AFBD230E0A62032263A52C5293252335C71211C688E2D86
- SPKI SHA-256: 271CF96AEDF03234E119F89D917F88493D93AF0C5BC2FF75E895B763618342A7
- Validity: 2007-01-25 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165146167 (0x9d7ee37)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 25 08:56:09 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Bielefeld, CN = Fachhochschule Bielefeld
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4F:24:78:1B:17:DE:C7:71:64:15:D7:72:EC:CF:6B:12:D9:1E:CB:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DD703F92AA2B4A596AFBD230E0A62032263A52C5293252335C71211C688E2D86
    SPKI SHA256: 271CF96AEDF03234E119F89D917F88493D93AF0C5BC2FF75E895B763618342A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Bielefeld

- Subject: countryName=DE, organizationName=Fachhochschule Bielefeld, commonName=Fachhochschule Bielefeld
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060CDE7B59D
- SHA-256: BCA4E4E59714AA5F3EC65DF43FE8314FE23EB7669BEAC6325D03E143BD763682
- SPKI SHA-256: 271CF96AEDF03234E119F89D917F88493D93AF0C5BC2FF75E895B763618342A7
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669910119837 (0x179060cde7b59d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:33 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Bielefeld, CN = Fachhochschule Bielefeld
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4F:24:78:1B:17:DE:C7:71:64:15:D7:72:EC:CF:6B:12:D9:1E:CB:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BCA4E4E59714AA5F3EC65DF43FE8314FE23EB7669BEAC6325D03E143BD763682
    SPKI SHA256: 271CF96AEDF03234E119F89D917F88493D93AF0C5BC2FF75E895B763618342A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Bonn-Rhein-Sieg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Fachhochschule Bonn-Rhein-Sieg, commonName=Fachhochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@fh-brs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D167AC4
- SHA-256: F1D8CFA3890C00237384DA8BD81CF95409CD75CB8955EF2246AFC89C92C2E6AA
- SPKI SHA-256: 36A65899A583FD104086CD53EC980BE675F6F52A82FC3A9A5902640BF46CD528
- Validity: 2008-10-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 219577028 (0xd167ac4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 16 08:37:09 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, O = Fachhochschule Bonn-Rhein-Sieg, CN = Fachhochschule Bonn-Rhein-Sieg CA - G01, emailAddress = pki@fh-brs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0F:10:61:72:D7:BA:6F:D3:4C:48:44:F8:C8:A2:14:E3:09:B8:A3:7F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-brs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F1D8CFA3890C00237384DA8BD81CF95409CD75CB8955EF2246AFC89C92C2E6AA
    SPKI SHA256: 36A65899A583FD104086CD53EC980BE675F6F52A82FC3A9A5902640BF46CD528
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule fuer Technik und Wirtschaft Berlin - G02

- Subject: countryName=DE, organizationName=Fachhochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Fachhochschule fuer Technik und Wirtschaft Berlin - G02, emailAddress=ca@fhtw-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DD6689
- SHA-256: 46D3097BB827B52566F0A87A4D5B1D72C42AC1DD9A6A9FD8AD2A2B2AAD6D8559
- SPKI SHA-256: C95F600FEDD6C80C6E48C7E0E5341BC6E685F6410081CDB04243ED45CF25A20F
- Validity: 2007-01-29 to 2019-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165504649 (0x9dd6689)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 29 12:30:51 2007 GMT
            Not After : Jan 28 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule fuer Technik und Wirtschaft Berlin, OU = HRZ, CN = Fachhochschule fuer Technik und Wirtschaft Berlin - G02, emailAddress = ca@fhtw-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                DD:30:89:F3:D2:E4:FA:7E:1E:EC:4B:53:30:41:1B:1C:64:D7:DE:BB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fhtw-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 46D3097BB827B52566F0A87A4D5B1D72C42AC1DD9A6A9FD8AD2A2B2AAD6D8559
    SPKI SHA256: C95F600FEDD6C80C6E48C7E0E5341BC6E685F6410081CDB04243ED45CF25A20F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Giessen-Friedberg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Giessen-Friedberg, commonName=Fachhochschule Giessen-Friedberg CA - G02, emailAddress=pki-gifb@fh-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB18C
- SHA-256: FA026E54281147F2525ACF75A15C5E77241CE5AA51E7974300FBE96F60BB438A
- SPKI SHA-256: E3BB53F2F7199BDAC87DD979BBDBA2834DAD10EC765CC8618200F89A286255F8
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604044 (0xa0cb18c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:25 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Giessen-Friedberg, CN = Fachhochschule Giessen-Friedberg CA - G02, emailAddress = pki-gifb@fh-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                34:D4:42:C1:93:A3:BB:57:6C:0C:77:EE:7C:95:1F:46:43:AF:30:D6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-gifb@fh-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA026E54281147F2525ACF75A15C5E77241CE5AA51E7974300FBE96F60BB438A
    SPKI SHA256: E3BB53F2F7199BDAC87DD979BBDBA2834DAD10EC765CC8618200F89A286255F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Giessen-Friedberg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Giessen-Friedberg, commonName=Fachhochschule Giessen-Friedberg CA - G02, emailAddress=pki-gifb@fh-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060EF0B35B8
- SHA-256: B923E16EFC71B18FDD773597B4239D12188AD1A8C23543A81C262A31508D080D
- SPKI SHA-256: E3BB53F2F7199BDAC87DD979BBDBA2834DAD10EC765CC8618200F89A286255F8
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670466094520 (0x179060ef0b35b8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:07 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Giessen-Friedberg, CN = Fachhochschule Giessen-Friedberg CA - G02, emailAddress = pki-gifb@fh-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                34:D4:42:C1:93:A3:BB:57:6C:0C:77:EE:7C:95:1F:46:43:AF:30:D6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-gifb@fh-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B923E16EFC71B18FDD773597B4239D12188AD1A8C23543A81C262A31508D080D
    SPKI SHA256: E3BB53F2F7199BDAC87DD979BBDBA2834DAD10EC765CC8618200F89A286255F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Hannover CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Fachhochschule Hannover, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Hannover CA, emailAddress=pki@fh-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42484B61D61
- SHA-256: 812C096FDC7CA293E7C3ABA5A3F1CED7754E5D3705B642FF5467838BAB55592B
- SPKI SHA-256: 9C28DF9C6FF164311FCBD22BAD2BB1799B30DCF416EA73FF7487C916F3C41358
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401216650593 (0x17a42484b61d61)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Fachhochschule Hannover, OU = Rechenzentrum, CN = Fachhochschule Hannover CA, emailAddress = pki@fh-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                95:72:BB:CC:6A:F1:F1:BF:7D:32:74:CF:29:6C:B5:F6:41:66:E2:48
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 812C096FDC7CA293E7C3ABA5A3F1CED7754E5D3705B642FF5467838BAB55592B
    SPKI SHA256: 9C28DF9C6FF164311FCBD22BAD2BB1799B30DCF416EA73FF7487C916F3C41358
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Hannover CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Fachhochschule Hannover, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Hannover CA, emailAddress=pki@fh-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AB6F504
- SHA-256: A5BB2A89F39093BEBB51AEE202C05807F329B7EDD89DB35A658621978A94DD8A
- SPKI SHA-256: 9C28DF9C6FF164311FCBD22BAD2BB1799B30DCF416EA73FF7487C916F3C41358
- Validity: 2007-07-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179762436 (0xab6f504)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 13 13:00:39 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Fachhochschule Hannover, OU = Rechenzentrum, CN = Fachhochschule Hannover CA, emailAddress = pki@fh-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                95:72:BB:CC:6A:F1:F1:BF:7D:32:74:CF:29:6C:B5:F6:41:66:E2:48
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A5BB2A89F39093BEBB51AEE202C05807F329B7EDD89DB35A658621978A94DD8A
    SPKI SHA256: 9C28DF9C6FF164311FCBD22BAD2BB1799B30DCF416EA73FF7487C916F3C41358
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Kiel

- Subject: countryName=DE, organizationName=Fachhochschule Kiel, commonName=Fachhochschule Kiel, emailAddress=ca@fh-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0F4E79
- SHA-256: 01E144B3FB9561603CA77DC82C639BCDA7984FFA1317A48673D522AD3A0A4502
- SPKI SHA-256: 6AC691AEF42A65915A2BFD641A7FF566BF6189ECE4A9138FC8724514B60FB2FA
- Validity: 2007-03-08 to 2019-03-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168775289 (0xa0f4e79)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  8 09:01:30 2007 GMT
            Not After : Mar  7 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Kiel, CN = Fachhochschule Kiel, emailAddress = ca@fh-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                91:5E:47:24:A4:13:31:63:E5:4B:07:D8:9E:21:64:5A:60:CA:7C:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 01E144B3FB9561603CA77DC82C639BCDA7984FFA1317A48673D522AD3A0A4502
    SPKI SHA256: 6AC691AEF42A65915A2BFD641A7FF566BF6189ECE4A9138FC8724514B60FB2FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Kiel

- Subject: countryName=DE, organizationName=Fachhochschule Kiel, commonName=Fachhochschule Kiel, emailAddress=ca@fh-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F58F7F71
- SHA-256: 866F03B08FDFE688E36E5C319D99909BEDD684DC7EC7A41DEA40E684A61AD820
- SPKI SHA-256: 6AC691AEF42A65915A2BFD641A7FF566BF6189ECE4A9138FC8724514B60FB2FA
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670575427441 (0x179060f58f7f71)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:13 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Kiel, CN = Fachhochschule Kiel, emailAddress = ca@fh-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                91:5E:47:24:A4:13:31:63:E5:4B:07:D8:9E:21:64:5A:60:CA:7C:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 866F03B08FDFE688E36E5C319D99909BEDD684DC7EC7A41DEA40E684A61AD820
    SPKI SHA256: 6AC691AEF42A65915A2BFD641A7FF566BF6189ECE4A9138FC8724514B60FB2FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Landshut CA - G01

- Subject: countryName=DE, localityName=Landshut, organizationName=Fachhochschule Landshut, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Landshut CA - G01, emailAddress=ca@fh-landshut.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DFDDC5
- SHA-256: DA0DF60F8A72FBBC49CB198D8F2FEEE59FDFBA4E3FD0161238552CD3E238E9B4
- SPKI SHA-256: C5E85D14761D71872BAC93A80619141E14C86A65ECF598022512CA6BD3ED7A7A
- Validity: 2007-01-31 to 2019-01-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165666245 (0x9dfddc5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 31 09:24:07 2007 GMT
            Not After : Jan 30 00:00:00 2019 GMT
        Subject: C = DE, L = Landshut, O = Fachhochschule Landshut, OU = Rechenzentrum, CN = Fachhochschule Landshut CA - G01, emailAddress = ca@fh-landshut.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4E:E3:D9:F1:E2:E1:00:DB:8A:A3:C0:D4:45:34:9E:8D:06:2D:BA:35
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-landshut.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DA0DF60F8A72FBBC49CB198D8F2FEEE59FDFBA4E3FD0161238552CD3E238E9B4
    SPKI SHA256: C5E85D14761D71872BAC93A80619141E14C86A65ECF598022512CA6BD3ED7A7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Landshut CA - G01

- Subject: countryName=DE, localityName=Landshut, organizationName=Fachhochschule Landshut, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Landshut CA - G01, emailAddress=ca@fh-landshut.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181E900D208B67
- SHA-256: DB5A80C5B4758BF21F97FA66F60D0594F7C811235E21507217117E8F5EBD3742
- SPKI SHA-256: C5E85D14761D71872BAC93A80619141E14C86A65ECF598022512CA6BD3ED7A7A
- Validity: 2014-08-28 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6789003485416295 (0x181e900d208b67)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 28 11:29:01 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, L = Landshut, O = Fachhochschule Landshut, OU = Rechenzentrum, CN = Fachhochschule Landshut CA - G01, emailAddress = ca@fh-landshut.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                4E:E3:D9:F1:E2:E1:00:DB:8A:A3:C0:D4:45:34:9E:8D:06:2D:BA:35
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-landshut.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DB5A80C5B4758BF21F97FA66F60D0594F7C811235E21507217117E8F5EBD3742
    SPKI SHA256: C5E85D14761D71872BAC93A80619141E14C86A65ECF598022512CA6BD3ED7A7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Luebeck CA - G01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Fachhochschule Luebeck, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Luebeck CA - G01, emailAddress=ca@fh-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6CC589619
- SHA-256: 70E72A3689B4AC1FAA0661D050BADB14C74B190F3D61786BD53D383971DFA4C7
- SPKI SHA-256: 4C872A7B6C5AEADAF68346AB24579B5D2D27EE9256C452D2A70D27B76300738C
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398989518361 (0x17aff6cc589619)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Luebeck, O = Fachhochschule Luebeck, OU = Rechenzentrum, CN = Fachhochschule Luebeck CA - G01, emailAddress = ca@fh-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3D:B5:F5:08:65:EC:BD:7E:10:DA:ED:96:F3:B0:F9:AF:49:B7:57:53
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 70E72A3689B4AC1FAA0661D050BADB14C74B190F3D61786BD53D383971DFA4C7
    SPKI SHA256: 4C872A7B6C5AEADAF68346AB24579B5D2D27EE9256C452D2A70D27B76300738C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Luebeck CA - G01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Fachhochschule Luebeck, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Luebeck CA - G01, emailAddress=ca@fh-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F87AF2B
- SHA-256: C5E023C21D0CAE07E210CBAD196035BA0DBCE22B3334C235621F974D480BB2E6
- SPKI SHA-256: 4C872A7B6C5AEADAF68346AB24579B5D2D27EE9256C452D2A70D27B76300738C
- Validity: 2010-02-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 260550443 (0xf87af2b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  2 14:07:23 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Luebeck, O = Fachhochschule Luebeck, OU = Rechenzentrum, CN = Fachhochschule Luebeck CA - G01, emailAddress = ca@fh-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3D:B5:F5:08:65:EC:BD:7E:10:DA:ED:96:F3:B0:F9:AF:49:B7:57:53
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C5E023C21D0CAE07E210CBAD196035BA0DBCE22B3334C235621F974D480BB2E6
    SPKI SHA256: 4C872A7B6C5AEADAF68346AB24579B5D2D27EE9256C452D2A70D27B76300738C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Nordhausen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Nordhausen, organizationName=Fachhochschule Nordhausen, commonName=Fachhochschule Nordhausen CA - G01, emailAddress=pki@fh-nordhausen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E417C8DA
- SHA-256: C1B57662B3F56FD66F8D7A92D5D077CE16B0CC5EBE34AACFDB13B69398F4C350
- SPKI SHA-256: 37DA8219EFE5E5BFA9BE8A29044DF84B95AFD483395F28FCFC8A0E3287B237B3
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399387924698 (0x17aff6e417c8da)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:12 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Nordhausen, O = Fachhochschule Nordhausen, CN = Fachhochschule Nordhausen CA - G01, emailAddress = pki@fh-nordhausen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                29:51:87:C2:39:F9:98:3F:17:74:AF:0E:BF:F5:FE:EA:EC:4D:24:83
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-nordhausen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C1B57662B3F56FD66F8D7A92D5D077CE16B0CC5EBE34AACFDB13B69398F4C350
    SPKI SHA256: 37DA8219EFE5E5BFA9BE8A29044DF84B95AFD483395F28FCFC8A0E3287B237B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Nordhausen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Nordhausen, organizationName=Fachhochschule Nordhausen, commonName=Fachhochschule Nordhausen CA - G01, emailAddress=pki@fh-nordhausen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 109C483B
- SHA-256: 51F2BD1A183F7888D47E9A1727921D8DC3E525CA02AB0CC618AE1D944A4BB199
- SPKI SHA-256: 37DA8219EFE5E5BFA9BE8A29044DF84B95AFD483395F28FCFC8A0E3287B237B3
- Validity: 2010-08-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 278677563 (0x109c483b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 31 09:26:03 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Nordhausen, O = Fachhochschule Nordhausen, CN = Fachhochschule Nordhausen CA - G01, emailAddress = pki@fh-nordhausen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                29:51:87:C2:39:F9:98:3F:17:74:AF:0E:BF:F5:FE:EA:EC:4D:24:83
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-nordhausen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 51F2BD1A183F7888D47E9A1727921D8DC3E525CA02AB0CC618AE1D944A4BB199
    SPKI SHA256: 37DA8219EFE5E5BFA9BE8A29044DF84B95AFD483395F28FCFC8A0E3287B237B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Schmalkalden CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Schmalkalden, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Schmalkalden CA - G01, emailAddress=pki@fh-schmalkalden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10400393
- SHA-256: D3DB8D719C94723716411C812D6E20404757471308FC5F62E1A9C051C9D4D03B
- SPKI SHA-256: 14B40259A3DEB7F8677CCAEE9F260B7ED39EFC59E7A92223B82E016D4B3948F4
- Validity: 2010-06-22 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 272630675 (0x10400393)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 22 09:44:35 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Schmalkalden, OU = Rechenzentrum, CN = Fachhochschule Schmalkalden CA - G01, emailAddress = pki@fh-schmalkalden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                55:59:78:A1:68:00:CA:5E:5A:AF:1A:89:84:C7:09:01:FB:F8:55:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-schmalkalden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D3DB8D719C94723716411C812D6E20404757471308FC5F62E1A9C051C9D4D03B
    SPKI SHA256: 14B40259A3DEB7F8677CCAEE9F260B7ED39EFC59E7A92223B82E016D4B3948F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Schmalkalden CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Schmalkalden, organizationalUnitName=Rechenzentrum, commonName=Fachhochschule Schmalkalden CA - G01, emailAddress=pki@fh-schmalkalden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DFEBBF04
- SHA-256: 68024590B3967A3356A2A36038086B84E920E012DDE694C8DC90757D1B4BFECF
- SPKI SHA-256: 14B40259A3DEB7F8677CCAEE9F260B7ED39EFC59E7A92223B82E016D4B3948F4
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399317929732 (0x17aff6dfebbf04)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:07 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Schmalkalden, OU = Rechenzentrum, CN = Fachhochschule Schmalkalden CA - G01, emailAddress = pki@fh-schmalkalden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                55:59:78:A1:68:00:CA:5E:5A:AF:1A:89:84:C7:09:01:FB:F8:55:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-schmalkalden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 68024590B3967A3356A2A36038086B84E920E012DDE694C8DC90757D1B4BFECF
    SPKI SHA256: 14B40259A3DEB7F8677CCAEE9F260B7ED39EFC59E7A92223B82E016D4B3948F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3)

- Subject: countryName=DE, organizationName=Fachhochschule Wuerzburg-Schweinfurt, commonName=Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress=ca@fh-sw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A5553623
- SHA-256: 2E5F7A820CAA743DA48A628DF7FCC1490184B3E3D0F71A59322949DB09C9FC4F
- SPKI SHA-256: FBF8E37D61312159C1ACBD1910C703B44BF947A7B766680478FB24CEE7653542
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401763948067 (0x17a424a5553623)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:13 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Wuerzburg-Schweinfurt, CN = Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress = ca@fh-sw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E5:67:07:8E:49:CA:EA:74:CA:E5:91:F5:D2:0D:A2:AA:D0:2C:BA:A6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-sw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E5F7A820CAA743DA48A628DF7FCC1490184B3E3D0F71A59322949DB09C9FC4F
    SPKI SHA256: FBF8E37D61312159C1ACBD1910C703B44BF947A7B766680478FB24CEE7653542
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3)

- Subject: countryName=DE, organizationName=Fachhochschule Wuerzburg-Schweinfurt, commonName=Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress=ca@fh-sw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BA6E4C8
- SHA-256: 9375B87ECC160EF49DF308814F49A086F3E14B91E9C951063C56EA03F6B9CEA1
- SPKI SHA-256: FBF8E37D61312159C1ACBD1910C703B44BF947A7B766680478FB24CEE7653542
- Validity: 2008-01-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 195486920 (0xba6e4c8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 11 12:55:22 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Wuerzburg-Schweinfurt, CN = Fachhochschule Wuerzburg-Schweinfurt CA 3 (FHWS-CA 3), emailAddress = ca@fh-sw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E5:67:07:8E:49:CA:EA:74:CA:E5:91:F5:D2:0D:A2:AA:D0:2C:BA:A6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-sw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9375B87ECC160EF49DF308814F49A086F3E14B91E9C951063C56EA03F6B9CEA1
    SPKI SHA256: FBF8E37D61312159C1ACBD1910C703B44BF947A7B766680478FB24CEE7653542
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FAU-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Erlangen, organizationName=Universitaet Erlangen-Nuernberg, organizationalUnitName=RRZE, commonName=FAU-CA, emailAddress=ca@rrze.uni-erlangen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A425350DC4BF
- SHA-256: 989A3AAA5862DEDE9B42D6F05EABD639A60F5D526C4AE128B98AA18FBC2F0F4A
- SPKI SHA-256: 429C4105F8901072AAC3A9162852354B73F0B676FD031153484751E1627E2476
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404175185087 (0x17a425350dc4bf)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Erlangen, O = Universitaet Erlangen-Nuernberg, OU = RRZE, CN = FAU-CA, emailAddress = ca@rrze.uni-erlangen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F4:73:F3:FA:C6:42:B3:C6:5C:69:C0:58:BE:74:38:F9:61:2B:8E:62
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rrze.uni-erlangen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 989A3AAA5862DEDE9B42D6F05EABD639A60F5D526C4AE128B98AA18FBC2F0F4A
    SPKI SHA256: 429C4105F8901072AAC3A9162852354B73F0B676FD031153484751E1627E2476
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FAU-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Erlangen, organizationName=Universitaet Erlangen-Nuernberg, organizationalUnitName=RRZE, commonName=FAU-CA, emailAddress=ca@rrze.uni-erlangen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ABE9F5E
- SHA-256: E6CF92DC9F3F34659B80274F8E1C2050FF25480A14C8B8FA4FC91109A1D8801B
- SPKI SHA-256: 429C4105F8901072AAC3A9162852354B73F0B676FD031153484751E1627E2476
- Validity: 2007-07-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180264798 (0xabe9f5e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 19 08:33:19 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Erlangen, O = Universitaet Erlangen-Nuernberg, OU = RRZE, CN = FAU-CA, emailAddress = ca@rrze.uni-erlangen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F4:73:F3:FA:C6:42:B3:C6:5C:69:C0:58:BE:74:38:F9:61:2B:8E:62
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rrze.uni-erlangen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E6CF92DC9F3F34659B80274F8E1C2050FF25480A14C8B8FA4FC91109A1D8801B
    SPKI SHA256: 429C4105F8901072AAC3A9162852354B73F0B676FD031153484751E1627E2476
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FCH CA - G02

- Subject: countryName=DE, organizationName=FIZ CHEMIE Berlin GmbH, commonName=FCH CA - G02, emailAddress=fch-ca@fiz-chemie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93DAA
- SHA-256: 20FE7102CE575C76D3BA6BE0511D10266E5CAF51F4B471EEDF8C33F52B768E14
- SPKI SHA-256: F29949CC27FCA8E1D6BD5200BD76EF7A4A3E7D9EC00E49A7958201D92E44CFF1
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329194 (0x9f93daa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:19:55 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, O = FIZ CHEMIE Berlin GmbH, CN = FCH CA - G02, emailAddress = fch-ca@fiz-chemie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                53:F1:C7:34:09:F7:F7:55:5C:94:BB:43:B6:8E:9D:B9:71:AB:B2:F8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fch-ca@fiz-chemie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 20FE7102CE575C76D3BA6BE0511D10266E5CAF51F4B471EEDF8C33F52B768E14
    SPKI SHA256: F29949CC27FCA8E1D6BD5200BD76EF7A4A3E7D9EC00E49A7958201D92E44CFF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FernUniversitaet in Hagen Global CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hagen, organizationName=FernUniversitaet in Hagen, organizationalUnitName=Zentrum fuer Medien und IT, commonName=FernUniversitaet in Hagen Global CA, emailAddress=caadmin@fernuni-hagen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E5AEA1D
- SHA-256: B56FB7E430542235D31252EC4FE7F57EDA6527049B3F4F324327D20E66ACF307
- SPKI SHA-256: D4EBFCCB65408AADCC793C24727747640063076A9C356C583A7A71A660F2A58C
- Validity: 2009-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 240839197 (0xe5aea1d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 10:46:37 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Hagen, O = FernUniversitaet in Hagen, OU = Zentrum fuer Medien und IT, CN = FernUniversitaet in Hagen Global CA, emailAddress = caadmin@fernuni-hagen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5E:93:AF:9B:A8:B0:0C:7B:07:BF:F9:88:34:7F:70:44:97:23:94:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@fernuni-hagen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B56FB7E430542235D31252EC4FE7F57EDA6527049B3F4F324327D20E66ACF307
    SPKI SHA256: D4EBFCCB65408AADCC793C24727747640063076A9C356C583A7A71A660F2A58C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FernUniversitaet in Hagen Global CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hagen, organizationName=FernUniversitaet in Hagen, organizationalUnitName=Zentrum fuer Medien und IT, commonName=FernUniversitaet in Hagen Global CA, emailAddress=caadmin@fernuni-hagen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B3C6803A
- SHA-256: 0ECA146BEE318ED8F63577F0DEB50246C2BCE1D07E91BD3611D9093DA727D3AE
- SPKI SHA-256: D4EBFCCB65408AADCC793C24727747640063076A9C356C583A7A71A660F2A58C
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398577291322 (0x17aff6b3c6803a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:24 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Hagen, O = FernUniversitaet in Hagen, OU = Zentrum fuer Medien und IT, CN = FernUniversitaet in Hagen Global CA, emailAddress = caadmin@fernuni-hagen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5E:93:AF:9B:A8:B0:0C:7B:07:BF:F9:88:34:7F:70:44:97:23:94:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@fernuni-hagen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0ECA146BEE318ED8F63577F0DEB50246C2BCE1D07E91BD3611D9093DA727D3AE
    SPKI SHA256: D4EBFCCB65408AADCC793C24727747640063076A9C356C583A7A71A660F2A58C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Ansbach CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Fachhochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=FH Ansbach CA, emailAddress=ca@fh-ansbach.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ADA8E62
- SHA-256: 313E0671BC017F00A94B495022AD7072D38EE7635421BF3E514C50FDC78DF134
- SPKI SHA-256: 5C676FD660E1F989C32F26062FB33FD154668B1920B6E904DF9BE332830ADA23
- Validity: 2007-08-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 182095458 (0xada8e62)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  9 13:04:21 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ansbach, O = Fachhochschule Ansbach, OU = Hochschulrechenzentrum, CN = FH Ansbach CA, emailAddress = ca@fh-ansbach.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2B:B9:51:C7:33:34:BD:C4:70:AD:77:76:51:D9:DF:77:4D:0D:0C:9C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-ansbach.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 313E0671BC017F00A94B495022AD7072D38EE7635421BF3E514C50FDC78DF134
    SPKI SHA256: 5C676FD660E1F989C32F26062FB33FD154668B1920B6E904DF9BE332830ADA23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Augsburg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Augsburg, organizationalUnitName=Rechenzentrum, commonName=FH Augsburg CA - G02, emailAddress=ca@fh-augsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A17431B
- SHA-256: BED0AE80DB4ED9AC099D9504D34F435D2C768A26235845CBDB18279BA4C27904
- SPKI SHA-256: A0439298172301AAE861D0249FB0D4CF50B62A86B481238B3D76D23AA06D6C39
- Validity: 2007-03-14 to 2019-03-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169296667 (0xa17431b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 14 09:51:09 2007 GMT
            Not After : Mar 13 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Augsburg, OU = Rechenzentrum, CN = FH Augsburg CA - G02, emailAddress = ca@fh-augsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D5:70:17:E3:DE:C1:97:F4:08:3E:E9:3A:11:B3:E8:88:F1:90:47:E4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-augsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BED0AE80DB4ED9AC099D9504D34F435D2C768A26235845CBDB18279BA4C27904
    SPKI SHA256: A0439298172301AAE861D0249FB0D4CF50B62A86B481238B3D76D23AA06D6C39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Augsburg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Augsburg, organizationalUnitName=Rechenzentrum, commonName=FH Augsburg CA - G02, emailAddress=ca@fh-augsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F9436EE0
- SHA-256: 3F93B0F5CD5AEE033BA21EA64291AA6D8C6F8CBD8601051D91AC43900B523B8B
- SPKI SHA-256: A0439298172301AAE861D0249FB0D4CF50B62A86B481238B3D76D23AA06D6C39
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670637551328 (0x179060f9436ee0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:17 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Augsburg, OU = Rechenzentrum, CN = FH Augsburg CA - G02, emailAddress = ca@fh-augsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D5:70:17:E3:DE:C1:97:F4:08:3E:E9:3A:11:B3:E8:88:F1:90:47:E4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-augsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F93B0F5CD5AEE033BA21EA64291AA6D8C6F8CBD8601051D91AC43900B523B8B
    SPKI SHA256: A0439298172301AAE861D0249FB0D4CF50B62A86B481238B3D76D23AA06D6C39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH fuer oeffentliche Verwaltung NRW CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule fuer oeffentliche Verwaltung Nordrhein-Westfalen, commonName=FH fuer oeffentliche Verwaltung NRW CA - G01, emailAddress=ca@fhoev.nrw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94E1D27A09
- SHA-256: 2E5DD5462EFC650258084639DB8DE6FE4E3F0D5A8FF635AD6CEE3DB899A8EFEB
- SPKI SHA-256: F23AA57ABBAAE8549C75A4352EEBEED2B05FFE39CDDE3AF41DD40D3AF17A3C26
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612002861644297 (0x177d94e1d27a09)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:41 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule fuer oeffentliche Verwaltung Nordrhein-Westfalen, CN = FH fuer oeffentliche Verwaltung NRW CA - G01, emailAddress = ca@fhoev.nrw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8F:56:EF:C6:FC:F6:AE:24:54:D2:D2:2E:B4:27:64:DF:9C:D4:83:F5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fhoev.nrw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E5DD5462EFC650258084639DB8DE6FE4E3F0D5A8FF635AD6CEE3DB899A8EFEB
    SPKI SHA256: F23AA57ABBAAE8549C75A4352EEBEED2B05FFE39CDDE3AF41DD40D3AF17A3C26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Ingolstadt CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Fachhochschule Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=FH Ingolstadt CA - G01, emailAddress=pki@fh-ingolstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6B573
- SHA-256: CBF5F17207D0AC942F2A9BA1CBE96E0FE997616E62C382EDC0A3A35B74DB4089
- SPKI SHA-256: 30D5CEC7C050680A373BDF3213301B42F98F295C137D6941A01A6EA7F03BBCCC
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166114675 (0x9e6b573)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 13:57:57 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ingolstadt, O = Fachhochschule Ingolstadt, OU = Rechenzentrum, CN = FH Ingolstadt CA - G01, emailAddress = pki@fh-ingolstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A9:7C:92:FF:4F:AF:C6:30:5B:BF:62:80:92:EB:5A:44:D9:87:2E:B7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-ingolstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CBF5F17207D0AC942F2A9BA1CBE96E0FE997616E62C382EDC0A3A35B74DB4089
    SPKI SHA256: 30D5CEC7C050680A373BDF3213301B42F98F295C137D6941A01A6EA7F03BBCCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Koeln CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Koeln, commonName=FH Koeln CA - G01, emailAddress=ca@fh-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14A9CCF5EABA05
- SHA-256: E5633619C98D899A0B37824DABF33021A295B26F94896CB277EA059ABFD23A51
- SPKI SHA-256: 7B2481D0202C98AEC1E427C113EC4DCF0E3C9E600DFCE7A26451F7E2B823C5CB
- Validity: 2012-10-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5816197298436613 (0x14a9ccf5eaba05)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 26 08:52:53 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Koeln, CN = FH Koeln CA - G01, emailAddress = ca@fh-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9B:2A:9A:BA:8D:0D:7C:B2:E3:05:11:9F:1A:97:25:30:9A:34:BE:A0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E5633619C98D899A0B37824DABF33021A295B26F94896CB277EA059ABFD23A51
    SPKI SHA256: 7B2481D0202C98AEC1E427C113EC4DCF0E3C9E600DFCE7A26451F7E2B823C5CB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Koeln CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Koeln, commonName=FH Koeln CA - G01, emailAddress=ca@fh-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF70A00A851
- SHA-256: 5EB11FE9A5BE70A8D440B7680AAE1A6124CC9F0A80D456080986E30C1AF66A2B
- SPKI SHA-256: 7B2481D0202C98AEC1E427C113EC4DCF0E3C9E600DFCE7A26451F7E2B823C5CB
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400023943249 (0x17aff70a00a851)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Koeln, CN = FH Koeln CA - G01, emailAddress = ca@fh-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9B:2A:9A:BA:8D:0D:7C:B2:E3:05:11:9F:1A:97:25:30:9A:34:BE:A0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5EB11FE9A5BE70A8D440B7680AAE1A6124CC9F0A80D456080986E30C1AF66A2B
    SPKI SHA256: 7B2481D0202C98AEC1E427C113EC4DCF0E3C9E600DFCE7A26451F7E2B823C5CB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH LuH CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Lippe und Hoexter, commonName=FH LuH CA - G02, emailAddress=ca@fh-luh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB19E
- SHA-256: D2B5D49BE954081CD12DB571B25D13746AADA095FC91D8749EC52838AF3D4B02
- SPKI SHA-256: F9F6D21CB473E53B4CD11B682A8597A63058B4F7B0591856EF189FC16F26A4E3
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604062 (0xa0cb19e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:44 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Lippe und Hoexter, CN = FH LuH CA - G02, emailAddress = ca@fh-luh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                02:4E:5A:60:52:E5:74:A8:01:00:0C:D3:8E:B5:6E:FD:97:CC:04:2B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-luh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D2B5D49BE954081CD12DB571B25D13746AADA095FC91D8749EC52838AF3D4B02
    SPKI SHA256: F9F6D21CB473E53B4CD11B682A8597A63058B4F7B0591856EF189FC16F26A4E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Muenster CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muenster, organizationName=Fachhochschule Muenster, organizationalUnitName=Datenverarbeitungszentrale, commonName=FH Muenster CA - G01, emailAddress=ca@fh-muenster.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A1094833
- SHA-256: 515BCBC06EB405F97E87EDC61AA88BA13846151AA3D5D9504F4A60743336DC34
- SPKI SHA-256: 4095C12EFFE7DB6C5F688F2AF746B52434F40051C2C5DD0B1E23AFF61135DBC7
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401691863091 (0x17a424a1094833)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Muenster, O = Fachhochschule Muenster, OU = Datenverarbeitungszentrale, CN = FH Muenster CA - G01, emailAddress = ca@fh-muenster.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0A:F3:5B:BC:E4:31:80:D6:35:42:89:A6:D3:C3:CF:37:DE:D1:DF:D7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-muenster.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 515BCBC06EB405F97E87EDC61AA88BA13846151AA3D5D9504F4A60743336DC34
    SPKI SHA256: 4095C12EFFE7DB6C5F688F2AF746B52434F40051C2C5DD0B1E23AFF61135DBC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Muenster CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muenster, organizationName=Fachhochschule Muenster, organizationalUnitName=Datenverarbeitungszentrale, commonName=FH Muenster CA - G01, emailAddress=ca@fh-muenster.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B8B3407
- SHA-256: A84864446DE036A46C7D79B3B3758A8CF2131844C7EB16264E7A0EA4A6CC182E
- SPKI SHA-256: 4095C12EFFE7DB6C5F688F2AF746B52434F40051C2C5DD0B1E23AFF61135DBC7
- Validity: 2007-12-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193672199 (0xb8b3407)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 21 12:50:01 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Muenster, O = Fachhochschule Muenster, OU = Datenverarbeitungszentrale, CN = FH Muenster CA - G01, emailAddress = ca@fh-muenster.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0A:F3:5B:BC:E4:31:80:D6:35:42:89:A6:D3:C3:CF:37:DE:D1:DF:D7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-muenster.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A84864446DE036A46C7D79B3B3758A8CF2131844C7EB16264E7A0EA4A6CC182E
    SPKI SHA256: 4095C12EFFE7DB6C5F688F2AF746B52434F40051C2C5DD0B1E23AFF61135DBC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Neu-Ulm CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Neu-Ulm, organizationalUnitName=Rechenzentrum, commonName=FH Neu-Ulm CA - G01, emailAddress=pki@fh-neu-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42518492621
- SHA-256: A895641C51CF5988679C90B43D6FC9F3E3425239AF41C3F8A59FD45B771E53F2
- SPKI SHA-256: 369AA4A6FAF30D6B05F48E78E0967AF7809C2A9D5B8A9B2599403E92064CD03A
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403692537377 (0x17a42518492621)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Neu-Ulm, OU = Rechenzentrum, CN = FH Neu-Ulm CA - G01, emailAddress = pki@fh-neu-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D9:33:F8:B8:CE:B3:46:0E:A5:9E:FE:BF:09:3D:69:54:7A:DB:68:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-neu-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A895641C51CF5988679C90B43D6FC9F3E3425239AF41C3F8A59FD45B771E53F2
    SPKI SHA256: 369AA4A6FAF30D6B05F48E78E0967AF7809C2A9D5B8A9B2599403E92064CD03A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Neu-Ulm CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Neu-Ulm, organizationalUnitName=Rechenzentrum, commonName=FH Neu-Ulm CA - G01, emailAddress=pki@fh-neu-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AC57037
- SHA-256: 4EEDE07791A1439946E32803027A44A0205090C2B5FC23E3D6035996A568CC5C
- SPKI SHA-256: 369AA4A6FAF30D6B05F48E78E0967AF7809C2A9D5B8A9B2599403E92064CD03A
- Validity: 2007-07-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180711479 (0xac57037)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 24 12:38:00 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Neu-Ulm, OU = Rechenzentrum, CN = FH Neu-Ulm CA - G01, emailAddress = pki@fh-neu-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D9:33:F8:B8:CE:B3:46:0E:A5:9E:FE:BF:09:3D:69:54:7A:DB:68:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-neu-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4EEDE07791A1439946E32803027A44A0205090C2B5FC23E3D6035996A568CC5C
    SPKI SHA256: 369AA4A6FAF30D6B05F48E78E0967AF7809C2A9D5B8A9B2599403E92064CD03A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Osnabrueck CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Osnabrueck, organizationalUnitName=Fachdienst EDV, commonName=FH Osnabrueck CA - G02, emailAddress=certificate@fh-osnabrueck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A285C46
- SHA-256: 855BD21694347E5B37A5215CD652DAD07FAF8E4D71DA62A43C3AE3ABA73EDB38
- SPKI SHA-256: 5C940B53ACE0068A0F4B5914A12152D50354A3EFE4DAC30AA07D3A2638561059
- Validity: 2007-03-27 to 2019-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170417222 (0xa285c46)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 09:07:03 2007 GMT
            Not After : Mar 26 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Osnabrueck, OU = Fachdienst EDV, CN = FH Osnabrueck CA - G02, emailAddress = certificate@fh-osnabrueck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CD:7B:A1:2C:B7:30:CC:73:AC:AB:1E:64:D1:1C:3B:D6:C3:D0:C1:40
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:certificate@fh-osnabrueck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 855BD21694347E5B37A5215CD652DAD07FAF8E4D71DA62A43C3AE3ABA73EDB38
    SPKI SHA256: 5C940B53ACE0068A0F4B5914A12152D50354A3EFE4DAC30AA07D3A2638561059
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Potsdam CA - G01

- Subject: countryName=DE, organizationName=Fachhochschule Potsdam, commonName=FH Potsdam CA - G01, emailAddress=ca@fh-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17CCC7CB2AC7C1
- SHA-256: 7D84728F038CB16B802A6270D6DB1CB4AD0DD7E515B485F904B79159E4F3A24E
- SPKI SHA-256: 772CBDE98305CD7FCBF613B4B73D7E1DF215E1048AB1B10F5C8FA476C81BB69B
- Validity: 2014-06-27 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6699082943481793 (0x17ccc7cb2ac7c1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 27 10:40:59 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Potsdam, CN = FH Potsdam CA - G01, emailAddress = ca@fh-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FD:66:87:75:06:D1:3A:ED:76:E9:24:D6:76:11:97:91:1E:E9:C7:E6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7D84728F038CB16B802A6270D6DB1CB4AD0DD7E515B485F904B79159E4F3A24E
    SPKI SHA256: 772CBDE98305CD7FCBF613B4B73D7E1DF215E1048AB1B10F5C8FA476C81BB69B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Regensburg CA

- Subject: countryName=DE, organizationName=Fachhochschule Regensburg, commonName=FH Regensburg CA, emailAddress=pki@fh-regensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249174022C
- SHA-256: 8C61967E11AB257DD494D70E95F16164802BB8AF1A3EEA9050233B6850B4BBA9
- SPKI SHA-256: 19C385F46DEA2F7A3CBDAA65D34F21D6D7FD56E13D899D5998E55AB943F151C3
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401430422060 (0x17a4249174022c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Regensburg, CN = FH Regensburg CA, emailAddress = pki@fh-regensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0C:70:30:D6:A1:98:E2:FA:A5:5C:D5:5A:34:C9:39:25:E8:4C:94:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-regensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C61967E11AB257DD494D70E95F16164802BB8AF1A3EEA9050233B6850B4BBA9
    SPKI SHA256: 19C385F46DEA2F7A3CBDAA65D34F21D6D7FD56E13D899D5998E55AB943F151C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH Regensburg CA

- Subject: countryName=DE, organizationName=Fachhochschule Regensburg, commonName=FH Regensburg CA, emailAddress=pki@fh-regensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B4129D4
- SHA-256: 466D16A642DD1A4F83DDA03B00C01CAA0435FA7D3404BA6D330D913E35DC3DD5
- SPKI SHA-256: 19C385F46DEA2F7A3CBDAA65D34F21D6D7FD56E13D899D5998E55AB943F151C3
- Validity: 2007-10-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 188819924 (0xb4129d4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 26 08:58:45 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Regensburg, CN = FH Regensburg CA, emailAddress = pki@fh-regensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0C:70:30:D6:A1:98:E2:FA:A5:5C:D5:5A:34:C9:39:25:E8:4C:94:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-regensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 466D16A642DD1A4F83DDA03B00C01CAA0435FA7D3404BA6D330D913E35DC3DD5
    SPKI SHA256: 19C385F46DEA2F7A3CBDAA65D34F21D6D7FD56E13D899D5998E55AB943F151C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Stralsund CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Stralsund, organizationalUnitName=ZIK, commonName=FH Stralsund CA - G02, emailAddress=ca@fh-stralsund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E154BB
- SHA-256: 3B685900ADD0D56DCCB98F99B361F452C372456C1AF74D1319AD0B63B8C8AB87
- SPKI SHA-256: 2BEE95F117F939E3515DDB43A612A034E4B38DA431A96C79A0EAAEE56F824E01
- Validity: 2007-02-01 to 2019-01-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165762235 (0x9e154bb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  1 12:03:57 2007 GMT
            Not After : Jan 31 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Stralsund, OU = ZIK, CN = FH Stralsund CA - G02, emailAddress = ca@fh-stralsund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5F:BD:F9:51:7C:84:25:C7:13:7F:EB:FD:43:BA:9E:5E:A7:D4:25:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-stralsund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3B685900ADD0D56DCCB98F99B361F452C372456C1AF74D1319AD0B63B8C8AB87
    SPKI SHA256: 2BEE95F117F939E3515DDB43A612A034E4B38DA431A96C79A0EAAEE56F824E01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH Stralsund CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Stralsund, organizationalUnitName=ZIK, commonName=FH Stralsund CA - G02, emailAddress=ca@fh-stralsund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D45DDA40
- SHA-256: 628E3FFE1B1A88B6BDEF40F2E880DB32FC165BB9F5E0FABC1D635D76081BE1A5
- SPKI SHA-256: 2BEE95F117F939E3515DDB43A612A034E4B38DA431A96C79A0EAAEE56F824E01
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670018525760 (0x179060d45dda40)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Stralsund, OU = ZIK, CN = FH Stralsund CA - G02, emailAddress = ca@fh-stralsund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5F:BD:F9:51:7C:84:25:C7:13:7F:EB:FD:43:BA:9E:5E:A7:D4:25:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-stralsund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 628E3FFE1B1A88B6BDEF40F2E880DB32FC165BB9F5E0FABC1D635D76081BE1A5
    SPKI SHA256: 2BEE95F117F939E3515DDB43A612A034E4B38DA431A96C79A0EAAEE56F824E01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-Coburg CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Coburg, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, commonName=FH-Coburg CA, emailAddress=fhc-pki@fh-coburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4246DC206CA
- SHA-256: 33D915150FC99E402FA7C30E6A950C252E02E05EBCA6AA585F27B7FF0C554488
- SPKI SHA-256: AF8EE2ACB6500C0DFC944008D42B3E46161A52DEEBBC2536B723EDDEA6B0E5F2
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400831555274 (0x17a4246dc206ca)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:17 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Coburg, O = Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, CN = FH-Coburg CA, emailAddress = fhc-pki@fh-coburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4F:C8:5C:CD:7F:DB:99:88:DC:FD:F8:6F:F6:97:F0:0D:00:4B:33:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fhc-pki@fh-coburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 33D915150FC99E402FA7C30E6A950C252E02E05EBCA6AA585F27B7FF0C554488
    SPKI SHA256: AF8EE2ACB6500C0DFC944008D42B3E46161A52DEEBBC2536B723EDDEA6B0E5F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-Coburg CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Coburg, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, commonName=FH-Coburg CA, emailAddress=fhc-pki@fh-coburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A581BB2
- SHA-256: 2B5AC480686A5C0BD8654913002DB7BBE7E719CFA30705E57869D47398D4B4EC
- SPKI SHA-256: AF8EE2ACB6500C0DFC944008D42B3E46161A52DEEBBC2536B723EDDEA6B0E5F2
- Validity: 2007-05-02 to 2019-05-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 173546418 (0xa581bb2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  2 14:20:19 2007 GMT
            Not After : May  1 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Coburg, O = Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg, CN = FH-Coburg CA, emailAddress = fhc-pki@fh-coburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4F:C8:5C:CD:7F:DB:99:88:DC:FD:F8:6F:F6:97:F0:0D:00:4B:33:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fhc-pki@fh-coburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2B5AC480686A5C0BD8654913002DB7BBE7E719CFA30705E57869D47398D4B4EC
    SPKI SHA256: AF8EE2ACB6500C0DFC944008D42B3E46161A52DEEBBC2536B723EDDEA6B0E5F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-EL CA

- Subject: countryName=DE, organizationName=Fachhochschule Emden/Leer, commonName=FH-EL CA, emailAddress=pki@fh-el.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FB5F6EF
- SHA-256: 4D7C96693B1D8260A237A196971580DD187C1E541B7D12349A8363F366EC8B61
- SPKI SHA-256: E3507915FF505B22E56A794D8DB331941795119ED952930CB61D48BD41B5FC65
- Validity: 2010-03-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 263583471 (0xfb5f6ef)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  9 16:37:52 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Emden/Leer, CN = FH-EL CA, emailAddress = pki@fh-el.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                91:9D:E0:2F:05:EC:5B:FA:01:76:8D:2F:CD:61:B6:00:35:E1:9D:A8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-el.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4D7C96693B1D8260A237A196971580DD187C1E541B7D12349A8363F366EC8B61
    SPKI SHA256: E3507915FF505B22E56A794D8DB331941795119ED952930CB61D48BD41B5FC65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Erfurt-CA

- Subject: countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93D97
- SHA-256: 9B56E7342C048F28C7D6DE34B9075A7781DA6AA5DE1E2CFF0842D54A43E2037E
- SPKI SHA-256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329175 (0x9f93d97)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:19:37 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Erfurt, OU = Hochschulrechenzentrum, CN = FH-Erfurt-CA, emailAddress = hrz@fh-erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:0A:9D:DC:D3:C0:D8:E0:D1:CC:C7:3E:12:3B:68:DF:D2:51:FE:1C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hrz@fh-erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9B56E7342C048F28C7D6DE34B9075A7781DA6AA5DE1E2CFF0842D54A43E2037E
    SPKI SHA256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Erfurt-CA

- Subject: countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42552412B6D
- SHA-256: DE714A3DB5BF99096E4B3715DE6721A4508BAFF361466E05C0CE19AE2A8F7CF3
- SPKI SHA-256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404665092973 (0x17a42552412b6d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Erfurt, OU = Hochschulrechenzentrum, CN = FH-Erfurt-CA, emailAddress = hrz@fh-erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B1:0A:9D:DC:D3:C0:D8:E0:D1:CC:C7:3E:12:3B:68:DF:D2:51:FE:1C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hrz@fh-erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE714A3DB5BF99096E4B3715DE6721A4508BAFF361466E05C0CE19AE2A8F7CF3
    SPKI SHA256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-Erfurt-CA

- Subject: countryName=DE, organizationName=Fachhochschule Erfurt, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-Erfurt-CA, emailAddress=hrz@fh-erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A83A1B3
- SHA-256: 2D2086FCEDFE9E7FC269515E4DD86408852C05382D7669D01D62090D1FAC062E
- SPKI SHA-256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 176398771 (0xa83a1b3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 16:19:00 2007 GMT
            Not After : Feb 18 01:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Erfurt, OU = Hochschulrechenzentrum, CN = FH-Erfurt-CA, emailAddress = hrz@fh-erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:0A:9D:DC:D3:C0:D8:E0:D1:CC:C7:3E:12:3B:68:DF:D2:51:FE:1C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hrz@fh-erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2D2086FCEDFE9E7FC269515E4DD86408852C05382D7669D01D62090D1FAC062E
    SPKI SHA256: 6810FB58C15C8D02D3303B48A321A3300459975111920BDDFF79C4699887FBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Flensburg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Flensburg, organizationalUnitName=IT Dezernat, commonName=FH-Flensburg CA - G02, emailAddress=postmaster@fh-flensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060DAF1BC79
- SHA-256: AC98E9FFCA748C04CC1EE6135FE5C38EF0238B1357BB66EBC4F9A6F793D48CF8
- SPKI SHA-256: C4DFEB0350BD97A9BFE26D25EFCEA77950CE84CC20A2034E07792BB9D4880F17
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670128880761 (0x179060daf1bc79)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:47 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Flensburg, OU = IT Dezernat, CN = FH-Flensburg CA - G02, emailAddress = postmaster@fh-flensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                ED:79:34:E3:83:E6:62:52:D5:62:F5:71:53:E3:10:A3:EC:30:1A:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:postmaster@fh-flensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AC98E9FFCA748C04CC1EE6135FE5C38EF0238B1357BB66EBC4F9A6F793D48CF8
    SPKI SHA256: C4DFEB0350BD97A9BFE26D25EFCEA77950CE84CC20A2034E07792BB9D4880F17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-Flensburg CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Flensburg, organizationalUnitName=IT Dezernat, commonName=FH-Flensburg CA - G02, emailAddress=postmaster@fh-flensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6A042
- SHA-256: 93F6A066524EAD58F9C70242DC86A9E335007BFAAA17B1DA80F219B91FDEE726
- SPKI SHA-256: C4DFEB0350BD97A9BFE26D25EFCEA77950CE84CC20A2034E07792BB9D4880F17
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166109250 (0x9e6a042)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 12:27:32 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Flensburg, OU = IT Dezernat, CN = FH-Flensburg CA - G02, emailAddress = postmaster@fh-flensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                ED:79:34:E3:83:E6:62:52:D5:62:F5:71:53:E3:10:A3:EC:30:1A:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:postmaster@fh-flensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 93F6A066524EAD58F9C70242DC86A9E335007BFAAA17B1DA80F219B91FDEE726
    SPKI SHA256: C4DFEB0350BD97A9BFE26D25EFCEA77950CE84CC20A2034E07792BB9D4880F17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Frankfurt a.M. - CA

- Subject: countryName=DE, organizationName=Fachhochschule Frankfurt am Main, commonName=FH-Frankfurt a.M. - CA, emailAddress=ca@dv.fh-frankfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610698975A
- SHA-256: D8201EF406E60B60001357305D4442DA3E28EDB0558F20FF131146D7F5690D8C
- SPKI SHA-256: 6AEBC06DF5A975A650D9DCFBE5BD1E9F24B6EF1600CF364A7FDA2DBA1B299338
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670861236058 (0x1790610698975a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:31 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Frankfurt am Main, CN = FH-Frankfurt a.M. - CA, emailAddress = ca@dv.fh-frankfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8F:06:FF:ED:BE:EE:64:7D:53:53:2A:CE:19:60:8C:74:99:53:F5:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dv.fh-frankfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8201EF406E60B60001357305D4442DA3E28EDB0558F20FF131146D7F5690D8C
    SPKI SHA256: 6AEBC06DF5A975A650D9DCFBE5BD1E9F24B6EF1600CF364A7FDA2DBA1B299338
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-Frankfurt a.M. - CA

- Subject: countryName=DE, organizationName=Fachhochschule Frankfurt am Main, commonName=FH-Frankfurt a.M. - CA, emailAddress=ca@dv.fh-frankfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A29C552
- SHA-256: 6F344264C9DAB60BE70A7B95A3337B3255C3930DA6EB45464D74BF6EE21A0648
- SPKI SHA-256: 6AEBC06DF5A975A650D9DCFBE5BD1E9F24B6EF1600CF364A7FDA2DBA1B299338
- Validity: 2007-03-28 to 2019-03-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170509650 (0xa29c552)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 28 10:47:32 2007 GMT
            Not After : Mar 27 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Frankfurt am Main, CN = FH-Frankfurt a.M. - CA, emailAddress = ca@dv.fh-frankfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8F:06:FF:ED:BE:EE:64:7D:53:53:2A:CE:19:60:8C:74:99:53:F5:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@dv.fh-frankfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6F344264C9DAB60BE70A7B95A3337B3255C3930DA6EB45464D74BF6EE21A0648
    SPKI SHA256: 6AEBC06DF5A975A650D9DCFBE5BD1E9F24B6EF1600CF364A7FDA2DBA1B299338
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-OOW CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-OOW CA - G02, emailAddress=pki@fh-oow.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E154DB
- SHA-256: EF5E467F889C46F695F2F7C8D4C1B87A1C6971C26007B091E48A9DA7BD5AF762
- SPKI SHA-256: DF72A8768661542DF90AAD17FC1DEF12F8B266900475B1766E43401C8CEF58BB
- Validity: 2007-02-01 to 2019-01-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165762267 (0x9e154db)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  1 12:04:29 2007 GMT
            Not After : Jan 31 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, OU = Hochschulrechenzentrum, CN = FH-OOW CA - G02, emailAddress = pki@fh-oow.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7E:71:4B:D1:0F:13:D6:C7:28:97:62:C9:F0:5F:AF:1C:0A:91:0A:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-oow.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EF5E467F889C46F695F2F7C8D4C1B87A1C6971C26007B091E48A9DA7BD5AF762
    SPKI SHA256: DF72A8768661542DF90AAD17FC1DEF12F8B266900475B1766E43401C8CEF58BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-OOW CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, organizationalUnitName=Hochschulrechenzentrum, commonName=FH-OOW CA - G02, emailAddress=pki@fh-oow.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A42C015
- SHA-256: 7E6ED4334697D1EB9B25028511FB4600E53C73CF783EA385C06973A596151C8C
- SPKI SHA-256: DF72A8768661542DF90AAD17FC1DEF12F8B266900475B1766E43401C8CEF58BB
- Validity: 2007-04-16 to 2019-04-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 172146709 (0xa42c015)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 16 09:31:51 2007 GMT
            Not After : Apr 15 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven, OU = Hochschulrechenzentrum, CN = FH-OOW CA - G02, emailAddress = pki@fh-oow.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7E:71:4B:D1:0F:13:D6:C7:28:97:62:C9:F0:5F:AF:1C:0A:91:0A:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-oow.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7E6ED4334697D1EB9B25028511FB4600E53C73CF783EA385C06973A596151C8C
    SPKI SHA256: DF72A8768661542DF90AAD17FC1DEF12F8B266900475B1766E43401C8CEF58BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-RO CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Rosenheim, organizationalUnitName=Rechenzentrum, commonName=FH-RO CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060FAE72405
- SHA-256: 9F654B95F326A2237AF43C1DBE3CC84146E5FA1BFEAC3C14CC569FF3D92BD270
- SPKI SHA-256: 26E12D28357285E637528C3320BEFDDD7ADF4747E14AF0A138C0796A0A0B0F0D
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670665057285 (0x179060fae72405)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Rosenheim, OU = Rechenzentrum, CN = FH-RO CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                20:66:6E:25:2F:A9:63:4D:A2:E0:27:BA:89:7F:CB:15:BA:3F:AE:91
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9F654B95F326A2237AF43C1DBE3CC84146E5FA1BFEAC3C14CC569FF3D92BD270
    SPKI SHA256: 26E12D28357285E637528C3320BEFDDD7ADF4747E14AF0A138C0796A0A0B0F0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-RO CA - G02

- Subject: countryName=DE, organizationName=Fachhochschule Rosenheim, organizationalUnitName=Rechenzentrum, commonName=FH-RO CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A174325
- SHA-256: 88834AFC59510A7981A7CD0AC061531EC58A994C0854C63672F1DA003F31E92B
- SPKI SHA-256: 26E12D28357285E637528C3320BEFDDD7ADF4747E14AF0A138C0796A0A0B0F0D
- Validity: 2007-03-14 to 2019-03-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169296677 (0xa174325)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 14 09:51:19 2007 GMT
            Not After : Mar 13 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Rosenheim, OU = Rechenzentrum, CN = FH-RO CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                20:66:6E:25:2F:A9:63:4D:A2:E0:27:BA:89:7F:CB:15:BA:3F:AE:91
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 88834AFC59510A7981A7CD0AC061531EC58A994C0854C63672F1DA003F31E92B
    SPKI SHA256: 26E12D28357285E637528C3320BEFDDD7ADF4747E14AF0A138C0796A0A0B0F0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-SWF CA

- Subject: countryName=DE, organizationName=Fachhochschule Suedwestfalen, commonName=FH-SWF CA, emailAddress=pki@fh-swf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060FF1169B3
- SHA-256: 55F06948D2C9B413A77E2AC5A5EBC817E2CDE12FD7A66475E55AC2A539CCCB8E
- SPKI SHA-256: 4D606B91E0B12AE53C6C389466DF6CE6C0796B5D18A1C61A83414BAB53B766A7
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670734936499 (0x179060ff1169b3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Suedwestfalen, CN = FH-SWF CA, emailAddress = pki@fh-swf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AA:7C:4A:F2:CC:12:4F:C5:6B:25:5E:EC:5B:CD:34:E4:48:79:F4:33
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-swf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 55F06948D2C9B413A77E2AC5A5EBC817E2CDE12FD7A66475E55AC2A539CCCB8E
    SPKI SHA256: 4D606B91E0B12AE53C6C389466DF6CE6C0796B5D18A1C61A83414BAB53B766A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FH-SWF CA

- Subject: countryName=DE, organizationName=Fachhochschule Suedwestfalen, commonName=FH-SWF CA, emailAddress=pki@fh-swf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A18875A
- SHA-256: 5849ABE4E6040AD6BB51A2CC06C92B465F6D0BC19EAC46ABD072055F6F3076CF
- SPKI SHA-256: 4D606B91E0B12AE53C6C389466DF6CE6C0796B5D18A1C61A83414BAB53B766A7
- Validity: 2007-03-15 to 2019-03-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169379674 (0xa18875a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 15 08:54:36 2007 GMT
            Not After : Mar 14 00:00:00 2019 GMT
        Subject: C = DE, O = Fachhochschule Suedwestfalen, CN = FH-SWF CA, emailAddress = pki@fh-swf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AA:7C:4A:F2:CC:12:4F:C5:6B:25:5E:EC:5B:CD:34:E4:48:79:F4:33
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-swf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5849ABE4E6040AD6BB51A2CC06C92B465F6D0BC19EAC46ABD072055F6F3076CF
    SPKI SHA256: 4D606B91E0B12AE53C6C389466DF6CE6C0796B5D18A1C61A83414BAB53B766A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Westkueste CA

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Heide, organizationName=Fachhochschule Westkueste, organizationalUnitName=EDV Abteilung, commonName=FH-Westkueste CA, emailAddress=ca@fh-westkueste.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F9DE6C3
- SHA-256: EE45D1566211E78A49A38147041C5C48746720175CF8E7FCF3EFC0B65F71E8AF
- SPKI SHA-256: 971FBCBFDC41D3F7E5BDA3AFF2605ED45BDCD0984F661C534D198FBA47DF0AF1
- Validity: 2010-02-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 262006467 (0xf9de6c3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 10:34:28 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Heide, O = Fachhochschule Westkueste, OU = EDV Abteilung, CN = FH-Westkueste CA, emailAddress = ca@fh-westkueste.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                03:A2:54:DF:8A:14:C5:9E:4D:99:78:D9:5A:F1:AF:86:03:78:1B:73
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-westkueste.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EE45D1566211E78A49A38147041C5C48746720175CF8E7FCF3EFC0B65F71E8AF
    SPKI SHA256: 971FBCBFDC41D3F7E5BDA3AFF2605ED45BDCD0984F661C534D198FBA47DF0AF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FH-Westkueste CA

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Heide, organizationName=Fachhochschule Westkueste, organizationalUnitName=EDV Abteilung, commonName=FH-Westkueste CA, emailAddress=ca@fh-westkueste.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D1DA94DA
- SHA-256: 91991C1006743A24D242A2D94604A12ED54267D82312B3090B28F3D437A0B79C
- SPKI SHA-256: 971FBCBFDC41D3F7E5BDA3AFF2605ED45BDCD0984F661C534D198FBA47DF0AF1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399081923802 (0x17aff6d1da94da)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Heide, O = Fachhochschule Westkueste, OU = EDV Abteilung, CN = FH-Westkueste CA, emailAddress = ca@fh-westkueste.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                03:A2:54:DF:8A:14:C5:9E:4D:99:78:D9:5A:F1:AF:86:03:78:1B:73
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-westkueste.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91991C1006743A24D242A2D94604A12ED54267D82312B3090B28F3D437A0B79C
    SPKI SHA256: 971FBCBFDC41D3F7E5BDA3AFF2605ED45BDCD0984F661C534D198FBA47DF0AF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHB-CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Brandenburg an der Havel, organizationName=Fachhochschule Brandenburg, organizationalUnitName=ZIMK/Rechenzentrum, commonName=FHB-CA, emailAddress=fhb-ca@fh-brandenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CA699DF
- SHA-256: EA05D7CE1C80CE7E9EF09F8A429D1E07EBC44EA950E268889D953CC2756ABE1B
- SPKI SHA-256: 547F9272EDB3080E40D1BEEE0A57F7D3284B3F89CA88973AF7C292750627C37D
- Validity: 2008-07-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 212244959 (0xca699df)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 23 11:56:00 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Brandenburg an der Havel, O = Fachhochschule Brandenburg, OU = ZIMK/Rechenzentrum, CN = FHB-CA, emailAddress = fhb-ca@fh-brandenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                85:97:B4:AD:22:32:99:5F:62:A8:84:42:0D:6C:A7:93:F4:FB:55:ED
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fhb-ca@fh-brandenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EA05D7CE1C80CE7E9EF09F8A429D1E07EBC44EA950E268889D953CC2756ABE1B
    SPKI SHA256: 547F9272EDB3080E40D1BEEE0A57F7D3284B3F89CA88973AF7C292750627C37D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHB-CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Brandenburg an der Havel, organizationName=Fachhochschule Brandenburg, organizationalUnitName=ZIMK/Rechenzentrum, commonName=FHB-CA, emailAddress=fhb-ca@fh-brandenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424D4374E1B
- SHA-256: DD496FB0A83407227F208F982D6649E8C02A744BF2A6AEBC74B5A8558E803A19
- SPKI SHA-256: 547F9272EDB3080E40D1BEEE0A57F7D3284B3F89CA88973AF7C292750627C37D
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402550517275 (0x17a424d4374e1b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Brandenburg an der Havel, O = Fachhochschule Brandenburg, OU = ZIMK/Rechenzentrum, CN = FHB-CA, emailAddress = fhb-ca@fh-brandenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                85:97:B4:AD:22:32:99:5F:62:A8:84:42:0D:6C:A7:93:F4:FB:55:ED
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fhb-ca@fh-brandenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DD496FB0A83407227F208F982D6649E8C02A744BF2A6AEBC74B5A8558E803A19
    SPKI SHA256: 547F9272EDB3080E40D1BEEE0A57F7D3284B3F89CA88973AF7C292750627C37D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHDO-CA Global - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-CA Global - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906100ABF685
- SHA-256: E3C622F0B4C60F8ED32020C7A977943FF9551361138F8964D151DE2FF9D550F3
- SPKI SHA-256: 6DC11A6BF67EFDC7294201D9929B48C39E6723B0732C97F723FA6D350F73C567
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670761842309 (0x17906100abf685)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:24 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Fachhochschule Dortmund, CN = FHDO-CA Global - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                95:5D:51:89:D5:01:24:62:56:6D:19:8B:13:E1:A2:47:51:C4:E3:97
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E3C622F0B4C60F8ED32020C7A977943FF9551361138F8964D151DE2FF9D550F3
    SPKI SHA256: 6DC11A6BF67EFDC7294201D9929B48C39E6723B0732C97F723FA6D350F73C567
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHDO-CA Global - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-CA Global - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A1F4676
- SHA-256: EC009788FC29064B97790A5537F0A6656C234CAFD76C96CFCFA28E216C20B7E5
- SPKI SHA-256: 6DC11A6BF67EFDC7294201D9929B48C39E6723B0732C97F723FA6D350F73C567
- Validity: 2007-03-20 to 2019-03-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169821814 (0xa1f4676)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 20 11:43:35 2007 GMT
            Not After : Mar 19 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Fachhochschule Dortmund, CN = FHDO-CA Global - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                95:5D:51:89:D5:01:24:62:56:6D:19:8B:13:E1:A2:47:51:C4:E3:97
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EC009788FC29064B97790A5537F0A6656C234CAFD76C96CFCFA28E216C20B7E5
    SPKI SHA256: 6DC11A6BF67EFDC7294201D9929B48C39E6723B0732C97F723FA6D350F73C567
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHDO-Chipcard CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-Chipcard CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ED2B70F
- SHA-256: F3DCD82828CCA81A2CA4EB56978950946AB51FE1FBE293B3947DB1B88836627E
- SPKI SHA-256: 51F676CFDF7304FB681C7E96777953756344F012FAA58ACEA9C59D24F5E27D9F
- Validity: 2009-09-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 248690447 (0xed2b70f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 18 07:40:47 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Fachhochschule Dortmund, CN = FHDO-Chipcard CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2A:D9:EF:83:FF:28:53:7E:A0:F1:0E:F2:A1:BE:97:69:E6:E5:BE:A6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F3DCD82828CCA81A2CA4EB56978950946AB51FE1FBE293B3947DB1B88836627E
    SPKI SHA256: 51F676CFDF7304FB681C7E96777953756344F012FAA58ACEA9C59D24F5E27D9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHDO-Chipcard CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Fachhochschule Dortmund, commonName=FHDO-Chipcard CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1A64090A7052AD
- SHA-256: 84A875D653AC83848DD7FFB5FC6CB9EE352A1553AB19875885FC3D052719DA18
- SPKI SHA-256: 51F676CFDF7304FB681C7E96777953756344F012FAA58ACEA9C59D24F5E27D9F
- Validity: 2015-11-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7428339387093677 (0x1a64090a7052ad)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 12 12:52:10 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Fachhochschule Dortmund, CN = FHDO-Chipcard CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                2A:D9:EF:83:FF:28:53:7E:A0:F1:0E:F2:A1:BE:97:69:E6:E5:BE:A6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 84A875D653AC83848DD7FFB5FC6CB9EE352A1553AB19875885FC3D052719DA18
    SPKI SHA256: 51F676CFDF7304FB681C7E96777953756344F012FAA58ACEA9C59D24F5E27D9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHGE CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Gelsenkirchen, organizationName=Fachhochschule Gelsenkirchen, organizationalUnitName=ZIM-IT, commonName=FHGE CA - G01, emailAddress=pki@fh-gelsenkirchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E682888
- SHA-256: 901A30AF3C7F149DD3E0AC45046E31FF44AB5A7A49A74670553317A1E988E409
- SPKI SHA-256: CD811E41CF1955EF416C5BA91575E9BB80A8ED3D7EA18D845FBDED947B9218C2
- Validity: 2009-06-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 241707144 (0xe682888)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 29 11:52:25 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Gelsenkirchen, O = Fachhochschule Gelsenkirchen, OU = ZIM-IT, CN = FHGE CA - G01, emailAddress = pki@fh-gelsenkirchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5D:69:9F:73:5C:27:47:1B:B3:1B:85:D4:B3:10:C7:5E:15:EB:90:C0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-gelsenkirchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 901A30AF3C7F149DD3E0AC45046E31FF44AB5A7A49A74670553317A1E988E409
    SPKI SHA256: CD811E41CF1955EF416C5BA91575E9BB80A8ED3D7EA18D845FBDED947B9218C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHGE CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Gelsenkirchen, organizationName=Fachhochschule Gelsenkirchen, organizationalUnitName=ZIM-IT, commonName=FHGE CA - G01, emailAddress=pki@fh-gelsenkirchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1A640902E45793
- SHA-256: CFF15C981A8CF6D1BA3507AC66633D652698214E96997C63C4EE5C36BC297F86
- SPKI SHA-256: CD811E41CF1955EF416C5BA91575E9BB80A8ED3D7EA18D845FBDED947B9218C2
- Validity: 2015-11-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7428339260479379 (0x1a640902e45793)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 12 12:52:02 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Gelsenkirchen, O = Fachhochschule Gelsenkirchen, OU = ZIM-IT, CN = FHGE CA - G01, emailAddress = pki@fh-gelsenkirchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                5D:69:9F:73:5C:27:47:1B:B3:1B:85:D4:B3:10:C7:5E:15:EB:90:C0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-gelsenkirchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CFF15C981A8CF6D1BA3507AC66633D652698214E96997C63C4EE5C36BC297F86
    SPKI SHA256: CD811E41CF1955EF416C5BA91575E9BB80A8ED3D7EA18D845FBDED947B9218C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHJ CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Fachhochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=FHJ CA - G01, emailAddress=pki@fh-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AAD9F24
- SHA-256: 88906C5775F3B6CAA45B47E8BAE6BC01CA4038AC96CE5EB9D7647F712E461872
- SPKI SHA-256: 07F4E118BE0A62399529643D0AF3685D1A2F38192BF485C09AD1A279ED1FDAE0
- Validity: 2007-07-06 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179150628 (0xaad9f24)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  6 11:03:49 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Fachhochschule Jena, OU = ServiceZentrum Informatik, CN = FHJ CA - G01, emailAddress = pki@fh-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:1A:E9:FC:04:79:C4:FC:43:9D:12:7D:78:01:CB:98:B4:53:1C:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 88906C5775F3B6CAA45B47E8BAE6BC01CA4038AC96CE5EB9D7647F712E461872
    SPKI SHA256: 07F4E118BE0A62399529643D0AF3685D1A2F38192BF485C09AD1A279ED1FDAE0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHJ CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Fachhochschule Jena, organizationalUnitName=ServiceZentrum Informatik, commonName=FHJ CA - G01, emailAddress=pki@fh-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424811F0242
- SHA-256: A86F0DDD098641E72D397377361CD1D1353CC9E512776A0D7011B468E821BDC1
- SPKI SHA-256: 07F4E118BE0A62399529643D0AF3685D1A2F38192BF485C09AD1A279ED1FDAE0
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401156416066 (0x17a424811f0242)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Fachhochschule Jena, OU = ServiceZentrum Informatik, CN = FHJ CA - G01, emailAddress = pki@fh-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                16:1A:E9:FC:04:79:C4:FC:43:9D:12:7D:78:01:CB:98:B4:53:1C:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A86F0DDD098641E72D397377361CD1D1353CC9E512776A0D7011B468E821BDC1
    SPKI SHA256: 07F4E118BE0A62399529643D0AF3685D1A2F38192BF485C09AD1A279ED1FDAE0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHW Berlin CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, organizationName=Fachhochschule fuer Wirtschaft Berlin, commonName=FHW Berlin CA, emailAddress=pki@fhw-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE36888
- SHA-256: 9C592DD2AE4CB61B84FE4DD449B0FA00A197CAB8D919E48D7BEB127FFAA57178
- SPKI SHA-256: 4CBE10BB9C79E750A8AA9F25ED9A979FD014D784BD106FA2ED9691AF9BD05942
- Validity: 2008-02-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199452808 (0xbe36888)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 10:33:29 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, O = Fachhochschule fuer Wirtschaft Berlin, CN = FHW Berlin CA, emailAddress = pki@fhw-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:19:86:11:6A:08:F5:10:CE:49:FD:EA:6E:9C:76:C0:FE:1D:A8:F8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fhw-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9C592DD2AE4CB61B84FE4DD449B0FA00A197CAB8D919E48D7BEB127FFAA57178
    SPKI SHA256: 4CBE10BB9C79E750A8AA9F25ED9A979FD014D784BD106FA2ED9691AF9BD05942
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHW CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, organizationName=Fachhochschule Weihenstephan, commonName=FHW CA - G01, emailAddress=pki@fh-weihenstephan.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C140E17
- SHA-256: 042DB4CC7E4E1C19D976988A63F98815ED4E6D276DF536EEBA4140B879C2FB9F
- SPKI SHA-256: 1219A0456C7532BE10230B5061E85C86321EAD133E729F240E330CE809B13766
- Validity: 2008-04-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 202640919 (0xc140e17)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 08:08:40 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, O = Fachhochschule Weihenstephan, CN = FHW CA - G01, emailAddress = pki@fh-weihenstephan.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F1:E6:0E:B2:D6:A5:C0:16:D1:A8:2F:3A:BA:D0:AD:E1:0D:9C:5E:AB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-weihenstephan.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 042DB4CC7E4E1C19D976988A63F98815ED4E6D276DF536EEBA4140B879C2FB9F
    SPKI SHA256: 1219A0456C7532BE10230B5061E85C86321EAD133E729F240E330CE809B13766
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHW CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, organizationName=Fachhochschule Weihenstephan, commonName=FHW CA - G01, emailAddress=pki@fh-weihenstephan.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B5E75AC6
- SHA-256: 7F410087DAB22E5B07AAC60E5D96868063F731B91F35B6BD3179C582B0227369
- SPKI SHA-256: 1219A0456C7532BE10230B5061E85C86321EAD133E729F240E330CE809B13766
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402041961158 (0x17a424b5e75ac6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, O = Fachhochschule Weihenstephan, CN = FHW CA - G01, emailAddress = pki@fh-weihenstephan.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:E6:0E:B2:D6:A5:C0:16:D1:A8:2F:3A:BA:D0:AD:E1:0D:9C:5E:AB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-weihenstephan.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7F410087DAB22E5B07AAC60E5D96868063F731B91F35B6BD3179C582B0227369
    SPKI SHA256: 1219A0456C7532BE10230B5061E85C86321EAD133E729F240E330CE809B13766
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FHW-CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Fachhochschule Wiesbaden, organizationalUnitName=IT-Center, commonName=FHW-CA, emailAddress=fhw-ca@itc.fh-wiesbaden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C5629AF
- SHA-256: A1B63091096D309BBD205D12CD74AD1F40AE5B3DA6D1D794DF233341542617CD
- SPKI SHA-256: 9F9F1ACED9FB0E17BFFF539F879CA93C32F42B5019CF5B5B605E3FFBEBC55FE8
- Validity: 2008-05-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 206973359 (0xc5629af)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 23 11:36:00 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Wiesbaden, O = Fachhochschule Wiesbaden, OU = IT-Center, CN = FHW-CA, emailAddress = fhw-ca@itc.fh-wiesbaden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9D:FD:A5:21:79:80:4A:09:FE:B2:5F:3C:1F:97:59:72:09:30:1F:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:fhw-ca@itc.fh-wiesbaden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A1B63091096D309BBD205D12CD74AD1F40AE5B3DA6D1D794DF233341542617CD
    SPKI SHA256: 9F9F1ACED9FB0E17BFFF539F879CA93C32F42B5019CF5B5B605E3FFBEBC55FE8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHWF-CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Wolfenbuettel, organizationName=Fachhochschule Braunschweig/Wolfenbuettel, organizationalUnitName=Rechenzentrum, commonName=FHWF-CA, emailAddress=pki@fh-wolfenbuettel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B3541D0
- SHA-256: 47B488ED6D039B74652CD0D988578FDFE905405E761319D9542C69BC88043140
- SPKI SHA-256: 503A20C3A8168289D8ACD32DEEAEB537F706917F32DF462A914D9394CF0CE98A
- Validity: 2007-10-17 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 188039632 (0xb3541d0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 17 08:13:54 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Wolfenbuettel, O = Fachhochschule Braunschweig/Wolfenbuettel, OU = Rechenzentrum, CN = FHWF-CA, emailAddress = pki@fh-wolfenbuettel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                68:E5:11:91:AC:7E:98:65:AE:53:4D:0F:FA:42:71:C6:1A:63:7D:87
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-wolfenbuettel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 47B488ED6D039B74652CD0D988578FDFE905405E761319D9542C69BC88043140
    SPKI SHA256: 503A20C3A8168289D8ACD32DEEAEB537F706917F32DF462A914D9394CF0CE98A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FHWF-CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Wolfenbuettel, organizationName=Fachhochschule Braunschweig/Wolfenbuettel, organizationalUnitName=Rechenzentrum, commonName=FHWF-CA, emailAddress=pki@fh-wolfenbuettel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A425049A50FF
- SHA-256: 4DD6FA694EB09D2B8E0CEDE550ADF75247C769159291F7E19391ACD743CD3286
- SPKI SHA-256: 503A20C3A8168289D8ACD32DEEAEB537F706917F32DF462A914D9394CF0CE98A
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403362312447 (0x17a425049a50ff)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Wolfenbuettel, O = Fachhochschule Braunschweig/Wolfenbuettel, OU = Rechenzentrum, CN = FHWF-CA, emailAddress = pki@fh-wolfenbuettel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                68:E5:11:91:AC:7E:98:65:AE:53:4D:0F:FA:42:71:C6:1A:63:7D:87
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-wolfenbuettel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DD6FA694EB09D2B8E0CEDE550ADF75247C769159291F7E19391ACD743CD3286
    SPKI SHA256: 503A20C3A8168289D8ACD32DEEAEB537F706917F32DF462A914D9394CF0CE98A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FLI CA

- Subject: countryName=DE, organizationName=Friedrich-Loeffler-Institut, commonName=FLI CA, emailAddress=pki@fli.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B735244
- SHA-256: 8FF4CAB969CC6CD7CFBA2BD2BF2AD16902D2AFD24C1B703A7C371F19EDAE9A82
- SPKI SHA-256: 58F5FE8D019C8058C73761A938F59847AB5B636795A18B96115BEFE3E6BCF75F
- Validity: 2007-12-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 192107076 (0xb735244)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  3 10:04:38 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Friedrich-Loeffler-Institut, CN = FLI CA, emailAddress = pki@fli.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D7:49:43:7C:88:32:94:62:4C:BB:60:85:13:D1:60:FA:5C:7D:6A:44
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fli.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8FF4CAB969CC6CD7CFBA2BD2BF2AD16902D2AFD24C1B703A7C371F19EDAE9A82
    SPKI SHA256: 58F5FE8D019C8058C73761A938F59847AB5B636795A18B96115BEFE3E6BCF75F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FLI CA

- Subject: countryName=DE, organizationName=Friedrich-Loeffler-Institut, commonName=FLI CA, emailAddress=pki@fli.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42499268AA6
- SHA-256: 3B01D807428474254C6F08D0C598CBA68AAB9F6F89BEF57E945607194DF8AD05
- SPKI SHA-256: 58F5FE8D019C8058C73761A938F59847AB5B636795A18B96115BEFE3E6BCF75F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401559562918 (0x17a42499268aa6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:01 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Friedrich-Loeffler-Institut, CN = FLI CA, emailAddress = pki@fli.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D7:49:43:7C:88:32:94:62:4C:BB:60:85:13:D1:60:FA:5C:7D:6A:44
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fli.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B01D807428474254C6F08D0C598CBA68AAB9F6F89BEF57E945607194DF8AD05
    SPKI SHA256: 58F5FE8D019C8058C73761A938F59847AB5B636795A18B96115BEFE3E6BCF75F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fraunhofer Root CA 2007

- Subject: countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Root CA 2007
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 010C
- SHA-256: AC7855180B5C3166AC2A1BD2072D307B6A4F73D363132D522D7C5AB54E454F21
- SPKI SHA-256: F28A6030B856CED51D9BD64B852FEF52A2F9A7C24365B95D28F63D5949EC7EA8
- Validity: 2007-12-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pki.fraunhofer.de/cp/Certificate_Policy_Fraunhofer_Corporate_PKI.pdf, http://pki.fraunhofer.de/cp/Certification_Practice_Statement_Fraunhofer_Corporate_PKI.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 268 (0x10c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Dec  5 15:18:58 2007 GMT
            Not After : Jun 30 23:59:59 2019 GMT
        Subject: C = DE, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Root CA 2007
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2F:45:42:1E:31:05:80:D5:70:D8:F8:1D:57:CB:5B:7A:D5:3D:9C:F7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AC7855180B5C3166AC2A1BD2072D307B6A4F73D363132D522D7C5AB54E454F21
    SPKI SHA256: F28A6030B856CED51D9BD64B852FEF52A2F9A7C24365B95D28F63D5949EC7EA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/cgi-bin/service/af_DownloadARL.crl?-crl_format=X_509&-issuer=DT_ROOT_CA_2
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### Fraunhofer Service CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G01, emailAddress=pki@fraunhofer.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF704D1AE73
- SHA-256: 5A0A908DE41B3CE10E782124B6C5B69CB57A24A17FAC0510C647276841092B3C
- SPKI SHA-256: FE89F5A0C1446DA94E1AC4EFFC91C2099AF2D852C7645DD16FA68AA58C8AECE7
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399936978547 (0x17aff704d1ae73)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Service CA - G01, emailAddress = pki@fraunhofer.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1E:A2:DC:D6:01:48:55:40:8C:DE:EF:F5:9E:7A:82:B5:00:B2:6C:DF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fraunhofer.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5A0A908DE41B3CE10E782124B6C5B69CB57A24A17FAC0510C647276841092B3C
    SPKI SHA256: FE89F5A0C1446DA94E1AC4EFFC91C2099AF2D852C7645DD16FA68AA58C8AECE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fraunhofer Service CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G01, emailAddress=pki@fraunhofer.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 13C33F11E20125
- SHA-256: 78F9144543B0753D0F59B56CECEDEECB57BEF6C9DF05A6903D7517EBD8EE149D
- SPKI SHA-256: FE89F5A0C1446DA94E1AC4EFFC91C2099AF2D852C7645DD16FA68AA58C8AECE7
- Validity: 2012-05-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5562700207882533 (0x13c33f11e20125)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  4 11:46:09 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Service CA - G01, emailAddress = pki@fraunhofer.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1E:A2:DC:D6:01:48:55:40:8C:DE:EF:F5:9E:7A:82:B5:00:B2:6C:DF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fraunhofer.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 78F9144543B0753D0F59B56CECEDEECB57BEF6C9DF05A6903D7517EBD8EE149D
    SPKI SHA256: FE89F5A0C1446DA94E1AC4EFFC91C2099AF2D852C7645DD16FA68AA58C8AECE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fraunhofer Service CA - G02

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA - G02
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B63BAB8CF33FA
- SHA-256: ACBFAEBDCBCE1AC84C98CF24140B6061A97318E926215409DC0CF4C7BE506620
- SPKI SHA-256: 9379C8E48BD2075070CA4C89FA5BBC2D9A07B1329BF99AB62518405D1ECE8C15
- Validity: 2016-05-24 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/fraunhofer-service-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7709477986841594 (0x1b63bab8cf33fa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: May 24 11:38:16 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Service CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                00:44:34:97:1C:1F:2B:99:26:8D:16:A7:1D:60:68:95:ED:9A:97:AE
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ACBFAEBDCBCE1AC84C98CF24140B6061A97318E926215409DC0CF4C7BE506620
    SPKI SHA256: 9379C8E48BD2075070CA4C89FA5BBC2D9A07B1329BF99AB62518405D1ECE8C15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Fraunhofer Service CA 2007

- Subject: countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Service CA 2007
- Issuer: countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Root CA 2007
- Serial: 611DD861000000000004
- SHA-256: F4A5984324DE98BD979EF181A100CF940F2166173319A86A0D9D7C8FAC3B0A8F
- SPKI SHA-256: 7165E991ADE7916D86B466ABEBB6E457CA931C804E58CE1FBABAE509156FFB43
- Validity: 2008-04-28 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl, http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:1d:d8:61:00:00:00:00:00:04
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Root CA 2007
        Validity
            Not Before: Apr 28 09:03:06 2008 GMT
            Not After : Jun 30 23:59:59 2019 GMT
        Subject: C = DE, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Service CA 2007
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                38:4D:0C:1D:C4:77:A7:B3:F8:67:86:D0:18:51:9F:58:9F:1E:9E:25
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                2F:45:42:1E:31:05:80:D5:70:D8:F8:1D:57:CB:5B:7A:D5:3D:9C:F7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl
                  URI:http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
            Authority Information Access:
                CA Issuers - URI:http://cert.pki.fraunhofer.de/fhg-root-ca-2007.cer
                CA Issuers - URI:http://cert.fraunhofer-pki.de/fhg-root-ca-2007.cer
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F4A5984324DE98BD979EF181A100CF940F2166173319A86A0D9D7C8FAC3B0A8F
    SPKI SHA256: 7165E991ADE7916D86B466ABEBB6E457CA931C804E58CE1FBABAE509156FFB43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cert.pki.fraunhofer.de/fhg-root-ca-2007.cer, http://cert.fraunhofer-pki.de/fhg-root-ca-2007.cer
- CRL Distribution Points: http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl, http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fraunhofer User CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060A191746B
- SHA-256: D3BDD2C67CAF6D0BF79F4C1E9D78A971398542F407984B22A40FC25616BF5DA6
- SPKI SHA-256: D7CAA2C5ED9620C5DB91ACBA8D7CA5C03264CCC2C06EFA3A419AD5B7ECB5C4E5
- Validity: 2014-05-12 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669166269547 (0x179060a191746b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:04:49 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer User CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                11:4D:A4:77:B3:12:D6:06:F5:7E:8C:08:B8:1A:4A:CC:A2:79:B8:CD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D3BDD2C67CAF6D0BF79F4C1E9D78A971398542F407984B22A40FC25616BF5DA6
    SPKI SHA256: D7CAA2C5ED9620C5DB91ACBA8D7CA5C03264CCC2C06EFA3A419AD5B7ECB5C4E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fraunhofer User CA - G02

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA - G02
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B63BAC68B5242
- SHA-256: 562CBBCBDEBEEB3CB55946BDCE248CA4A623D2BA6E77B63B754D3A571F67DFA2
- SPKI SHA-256: B48DB99727EE6BE3884C2EF80FB27A67B4F22E2FD97F30E19E0EDFAD582607C4
- Validity: 2016-05-24 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/fraunhofer-user-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7709478217273922 (0x1b63bac68b5242)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: May 24 11:38:30 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer User CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                A3:26:F5:9A:4F:DB:DA:3B:E1:B5:AA:EE:58:8B:D0:FC:FF:B5:6D:51
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 562CBBCBDEBEEB3CB55946BDCE248CA4A623D2BA6E77B63B754D3A571F67DFA2
    SPKI SHA256: B48DB99727EE6BE3884C2EF80FB27A67B4F22E2FD97F30E19E0EDFAD582607C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Fraunhofer User CA 2007

- Subject: countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer User CA 2007
- Issuer: countryName=DE, organizationName=Fraunhofer, organizationalUnitName=Fraunhofer Corporate PKI, commonName=Fraunhofer Root CA 2007
- Serial: 611D3319000000000003
- SHA-256: 4BBA4B94290FB17C451B23C0019F1627D1ABFD4004FA6A6C513E9041985FE287
- SPKI SHA-256: B5C063E70B14A40C5C9C99FAD3F85F392801180E5C3EDEEBDF7784F96924F6E1
- Validity: 2007-12-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl, http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:1d:33:19:00:00:00:00:00:03
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer Root CA 2007
        Validity
            Not Before: Dec 12 14:49:35 2007 GMT
            Not After : Jun 30 23:59:59 2019 GMT
        Subject: C = DE, O = Fraunhofer, OU = Fraunhofer Corporate PKI, CN = Fraunhofer User CA 2007
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4F:1D:AF:88:CA:6D:B8:AA:1C:09:F9:C5:D1:11:ED:59:B4:93:FA:0B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                2F:45:42:1E:31:05:80:D5:70:D8:F8:1D:57:CB:5B:7A:D5:3D:9C:F7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl
                  URI:http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
            Authority Information Access:
                CA Issuers - URI:http://cert.pki.fraunhofer.de/fhg-root-ca-2007.cer
                CA Issuers - URI:http://cert.fraunhofer-pki.de/fhg-root-ca-2007.cer
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4BBA4B94290FB17C451B23C0019F1627D1ABFD4004FA6A6C513E9041985FE287
    SPKI SHA256: B5C063E70B14A40C5C9C99FAD3F85F392801180E5C3EDEEBDF7784F96924F6E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cert.pki.fraunhofer.de/fhg-root-ca-2007.cer, http://cert.fraunhofer-pki.de/fhg-root-ca-2007.cer
- CRL Distribution Points: http://crl.pki.fraunhofer.de/fhg-root-ca-2007.crl, http://crl.fraunhofer-pki.de/fhg-root-ca-2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Freie Hansestadt Bremen CA - G01

- Subject: countryName=DE, organizationName=Freie Hansestadt Bremen, commonName=Freie Hansestadt Bremen CA - G01, emailAddress=ca@bildung.bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14DC2F23B56A05
- SHA-256: B9BCD957B616EE33DD38B0FBF8E3A5CA7D763447A985706FB3D153E135DDFC87
- SPKI SHA-256: BB237B49B2173EEA4FA95D203572424B43F5E43C34C9A0E1D6E9358303B4BF05
- Validity: 2012-12-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5871594554878469 (0x14dc2f23b56a05)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  3 14:05:07 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Freie Hansestadt Bremen, CN = Freie Hansestadt Bremen CA - G01, emailAddress = ca@bildung.bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:F8:82:6C:F8:46:F1:53:39:23:B7:FC:4B:D9:55:1A:37:76:F2:77
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bildung.bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B9BCD957B616EE33DD38B0FBF8E3A5CA7D763447A985706FB3D153E135DDFC87
    SPKI SHA256: BB237B49B2173EEA4FA95D203572424B43F5E43C34C9A0E1D6E9358303B4BF05
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Freie Hansestadt Bremen CA - G01

- Subject: countryName=DE, organizationName=Freie Hansestadt Bremen, commonName=Freie Hansestadt Bremen CA - G01, emailAddress=ca@bildung.bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF70D2C850A
- SHA-256: 9EB53521F17CFF0932274C87B08D4A5A79847EDEEC36DD9247573D7CE3B2A458
- SPKI SHA-256: BB237B49B2173EEA4FA95D203572424B43F5E43C34C9A0E1D6E9358303B4BF05
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400077149450 (0x17aff70d2c850a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Freie Hansestadt Bremen, CN = Freie Hansestadt Bremen CA - G01, emailAddress = ca@bildung.bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:F8:82:6C:F8:46:F1:53:39:23:B7:FC:4B:D9:55:1A:37:76:F2:77
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@bildung.bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9EB53521F17CFF0932274C87B08D4A5A79847EDEEC36DD9247573D7CE3B2A458
    SPKI SHA256: BB237B49B2173EEA4FA95D203572424B43F5E43C34C9A0E1D6E9358303B4BF05
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Freie Universitaet Berlin - FU-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Freie Universitaet Berlin, organizationalUnitName=ZEDAT, commonName=Freie Universitaet Berlin - FU-CA - G01, emailAddress=ca@FU-Berlin.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09CDA528
- SHA-256: 30F036323487137C6452C4FDD06120EFA530388022FB4C58C959E17036C60559
- SPKI SHA-256: 38CBBE6D54EF38DAE5D4A721F13DEE163AC5906840BAA21F75B1542B28F1E13C
- Validity: 2007-01-17 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 164472104 (0x9cda528)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 17 13:41:46 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Freie Universitaet Berlin, OU = ZEDAT, CN = Freie Universitaet Berlin - FU-CA - G01, emailAddress = ca@FU-Berlin.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                06:E1:3D:F4:6F:F4:30:B7:7A:3B:57:B0:31:05:89:7B:0D:58:5A:6C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@FU-Berlin.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 30F036323487137C6452C4FDD06120EFA530388022FB4C58C959E17036C60559
    SPKI SHA256: 38CBBE6D54EF38DAE5D4A721F13DEE163AC5906840BAA21F75B1542B28F1E13C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Freie Universitaet Berlin - FU-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Freie Universitaet Berlin, organizationalUnitName=ZEDAT, commonName=Freie Universitaet Berlin - FU-CA - G01, emailAddress=ca@FU-Berlin.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060CCF9B96E
- SHA-256: 24728A96382CF82533DC69D92917839040223DA32B26C936DB7743AD498A5B95
- SPKI SHA-256: 38CBBE6D54EF38DAE5D4A721F13DEE163AC5906840BAA21F75B1542B28F1E13C
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669894523246 (0x179060ccf9b96e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:32 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Freie Universitaet Berlin, OU = ZEDAT, CN = Freie Universitaet Berlin - FU-CA - G01, emailAddress = ca@FU-Berlin.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                06:E1:3D:F4:6F:F4:30:B7:7A:3B:57:B0:31:05:89:7B:0D:58:5A:6C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@FU-Berlin.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 24728A96382CF82533DC69D92917839040223DA32B26C936DB7743AD498A5B95
    SPKI SHA256: 38CBBE6D54EF38DAE5D4A721F13DEE163AC5906840BAA21F75B1542B28F1E13C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Fritz-Haber-Institut CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Fritz-Haber-Institut der Max-Planck-Gesellschaft, organizationalUnitName=PPB, commonName=Fritz-Haber-Institut CA, emailAddress=pki@fhi-berlin.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D65AE56
- SHA-256: 1289FF7B7615FFBCA1EA49679DC2E25ACF90F0E9330A5256B43BDDD0C0443C0F
- SPKI SHA-256: 6AE9444A803E88985C8649CF19EC8393D9B52F437A1144EEE69F5CF0D05A3BEC
- Validity: 2008-12-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 224767574 (0xd65ae56)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 15 10:26:14 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Fritz-Haber-Institut der Max-Planck-Gesellschaft, OU = PPB, CN = Fritz-Haber-Institut CA, emailAddress = pki@fhi-berlin.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FC:63:44:CD:3C:D0:85:62:D6:CD:06:68:6B:42:3A:1F:23:2D:49:7C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fhi-berlin.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1289FF7B7615FFBCA1EA49679DC2E25ACF90F0E9330A5256B43BDDD0C0443C0F
    SPKI SHA256: 6AE9444A803E88985C8649CF19EC8393D9B52F437A1144EEE69F5CF0D05A3BEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Fritz-Haber-Institut CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Fritz-Haber-Institut der Max-Planck-Gesellschaft, organizationalUnitName=PPB, commonName=Fritz-Haber-Institut CA, emailAddress=pki@fhi-berlin.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A14E5ADF
- SHA-256: E472FFB64695E5E8DA7F30A86793232B45DFD0699290D2C62911B2544D98B1A2
- SPKI SHA-256: 6AE9444A803E88985C8649CF19EC8393D9B52F437A1144EEE69F5CF0D05A3BEC
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398267427551 (0x17aff6a14e5adf)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:05 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Fritz-Haber-Institut der Max-Planck-Gesellschaft, OU = PPB, CN = Fritz-Haber-Institut CA, emailAddress = pki@fhi-berlin.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FC:63:44:CD:3C:D0:85:62:D6:CD:06:68:6B:42:3A:1F:23:2D:49:7C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fhi-berlin.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E472FFB64695E5E8DA7F30A86793232B45DFD0699290D2C62911B2544D98B1A2
    SPKI SHA256: 6AE9444A803E88985C8649CF19EC8393D9B52F437A1144EEE69F5CF0D05A3BEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FV Berlin - PKI CA

- Subject: countryName=DE, organizationName=Forschungsverbund Berlin e.V., organizationalUnitName=Corporate Network, commonName=FV Berlin - PKI CA, emailAddress=pki-ca@fv-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424839410D5
- SHA-256: 172C2E6D42983C483DED4DCED414D3D9BBCA033939B06911F48F6E0DD816CF71
- SPKI SHA-256: E6D69EF96C89A1F231670155DA9A065678C83D45F98E3D8A1461401F7AD5FF78
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401197641941 (0x17a424839410d5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Forschungsverbund Berlin e.V., OU = Corporate Network, CN = FV Berlin - PKI CA, emailAddress = pki-ca@fv-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                45:A4:5C:1B:96:07:1F:00:CE:AF:E5:4C:D6:66:6E:19:57:D2:43:76
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@fv-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 172C2E6D42983C483DED4DCED414D3D9BBCA033939B06911F48F6E0DD816CF71
    SPKI SHA256: E6D69EF96C89A1F231670155DA9A065678C83D45F98E3D8A1461401F7AD5FF78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FV Berlin - PKI CA

- Subject: countryName=DE, organizationName=Forschungsverbund Berlin e.V., organizationalUnitName=Corporate Network, commonName=FV Berlin - PKI CA, emailAddress=pki-ca@fv-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AB59936
- SHA-256: 038C32FA8121E07C3BEF605487227CC30D4FBB5AFAB8C2D9354F9AA7E46B3537
- SPKI SHA-256: E6D69EF96C89A1F231670155DA9A065678C83D45F98E3D8A1461401F7AD5FF78
- Validity: 2007-07-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179673398 (0xab59936)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 12 12:16:40 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Forschungsverbund Berlin e.V., OU = Corporate Network, CN = FV Berlin - PKI CA, emailAddress = pki-ca@fv-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                45:A4:5C:1B:96:07:1F:00:CE:AF:E5:4C:D6:66:6E:19:57:D2:43:76
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@fv-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 038C32FA8121E07C3BEF605487227CC30D4FBB5AFAB8C2D9354F9AA7E46B3537
    SPKI SHA256: E6D69EF96C89A1F231670155DA9A065678C83D45F98E3D8A1461401F7AD5FF78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FZ-Borstel-CA - G01

- Subject: countryName=DE, organizationName=FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, organizationalUnitName=Netzzentrum, commonName=FZ-Borstel-CA - G01, emailAddress=ca@fz-borstel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71B15D66C
- SHA-256: F5ECE3EDE431E879D474AA6582427F105E1763D4B80170F5C707870587EE8851
- SPKI SHA-256: 0D5E7DC5EDEBE51DF53BD912D8DDD06BD448BF9E80B2F39EB35E011AB0CD492B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400310543980 (0x17aff71b15d66c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:07 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, OU = Netzzentrum, CN = FZ-Borstel-CA - G01, emailAddress = ca@fz-borstel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DC:DC:79:E4:DC:B5:C4:17:FE:72:90:E2:87:83:82:DF:AD:AF:EF:E5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fz-borstel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F5ECE3EDE431E879D474AA6582427F105E1763D4B80170F5C707870587EE8851
    SPKI SHA256: 0D5E7DC5EDEBE51DF53BD912D8DDD06BD448BF9E80B2F39EB35E011AB0CD492B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FZ-Borstel-CA - G01

- Subject: countryName=DE, organizationName=FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, organizationalUnitName=Netzzentrum, commonName=FZ-Borstel-CA - G01, emailAddress=ca@fz-borstel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 16500AD7C372FE
- SHA-256: 546DA342E55D2E579CC4DC23EDA8AAA5DC228AFE18612871EF2D7793D1EEB07F
- SPKI SHA-256: 0D5E7DC5EDEBE51DF53BD912D8DDD06BD448BF9E80B2F39EB35E011AB0CD492B
- Validity: 2013-09-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6280456987439870 (0x16500ad7c372fe)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 11 15:33:27 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = FZ-Borstel - Leibniz-Zentrum fuer Medizin und Biowissenschaften, OU = Netzzentrum, CN = FZ-Borstel-CA - G01, emailAddress = ca@fz-borstel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DC:DC:79:E4:DC:B5:C4:17:FE:72:90:E2:87:83:82:DF:AD:AF:EF:E5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fz-borstel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 546DA342E55D2E579CC4DC23EDA8AAA5DC228AFE18612871EF2D7793D1EEB07F
    SPKI SHA256: 0D5E7DC5EDEBE51DF53BD912D8DDD06BD448BF9E80B2F39EB35E011AB0CD492B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FZD-CA - G02

- Subject: countryName=DE, organizationName=Forschungszentrum Dresden-Rossendorf e.V., organizationalUnitName=Informationstechnologie, commonName=FZD-CA - G02, emailAddress=ra@fzd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6A00C
- SHA-256: 1A3C24059794BF17DCD77371958B2C70949D55CBC4CED9D0F0E15F1517724C8E
- SPKI SHA-256: 21101B80DDB2B7D017B3839BA59846869CE8EEEE2B552B496056F2ECC0C126BF
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166109196 (0x9e6a00c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 12:26:37 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = Forschungszentrum Dresden-Rossendorf e.V., OU = Informationstechnologie, CN = FZD-CA - G02, emailAddress = ra@fzd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A5:29:48:F5:95:99:18:B5:3E:37:C8:86:02:8A:4E:BF:42:F0:1D:8C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@fzd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1A3C24059794BF17DCD77371958B2C70949D55CBC4CED9D0F0E15F1517724C8E
    SPKI SHA256: 21101B80DDB2B7D017B3839BA59846869CE8EEEE2B552B496056F2ECC0C126BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FZD-CA - G02

- Subject: countryName=DE, organizationName=Forschungszentrum Dresden-Rossendorf e.V., organizationalUnitName=Informationstechnologie, commonName=FZD-CA - G02, emailAddress=ra@fzd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D84716E7
- SHA-256: 65FCE49538B0755B8C17E5BBD3FF48CE20304696239D8A5553813B8BEF62E271
- SPKI SHA-256: 21101B80DDB2B7D017B3839BA59846869CE8EEEE2B552B496056F2ECC0C126BF
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670084142823 (0x179060d84716e7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Forschungszentrum Dresden-Rossendorf e.V., OU = Informationstechnologie, CN = FZD-CA - G02, emailAddress = ra@fzd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A5:29:48:F5:95:99:18:B5:3E:37:C8:86:02:8A:4E:BF:42:F0:1D:8C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@fzd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 65FCE49538B0755B8C17E5BBD3FF48CE20304696239D8A5553813B8BEF62E271
    SPKI SHA256: 21101B80DDB2B7D017B3839BA59846869CE8EEEE2B552B496056F2ECC0C126BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FZI CA - G01

- Subject: countryName=DE, organizationName=FZI Forschungszentrum Informatik, commonName=FZI CA - G01, emailAddress=ca@fzi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 186EDBB8D425BC
- SHA-256: 497AC0E74F7B079A6E5BB6ABD072DBD237C9424219E6B08E6BACAE1E3351427F
- SPKI SHA-256: 58AABFB4E33115701B60045778432536775EAD92704A5AA1D6E2569EF0C15786
- Validity: 2014-10-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6877289418859964 (0x186edbb8d425bc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 28 09:13:12 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = FZI Forschungszentrum Informatik, CN = FZI CA - G01, emailAddress = ca@fzi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                12:CC:64:F7:6A:A1:53:3F:F4:5A:68:CB:2C:49:B8:E8:0A:1F:B3:4C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fzi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 497AC0E74F7B079A6E5BB6ABD072DBD237C9424219E6B08E6BACAE1E3351427F
    SPKI SHA256: 58AABFB4E33115701B60045778432536775EAD92704A5AA1D6E2569EF0C15786
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FZJ Certification Authority - G02

- Subject: countryName=DE, organizationName=Forschungszentrum Juelich GmbH, commonName=FZJ Certification Authority - G02, emailAddress=ca@fz-juelich.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B870814
- SHA-256: 51F375397068B6D0369C1785777AF1DC7D787EBCD4B540D37701CEF5EBE925B9
- SPKI SHA-256: 4C4347EFF107F482C5C01DAA8F43AE84ABFED3D988CAE036285C8DDFB6F00D7F
- Validity: 2007-12-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193398804 (0xb870814)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 18 08:53:26 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Forschungszentrum Juelich GmbH, CN = FZJ Certification Authority - G02, emailAddress = ca@fz-juelich.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                20:BD:71:89:A5:C9:2A:33:2F:11:E0:1F:E5:94:26:56:0F:11:02:25
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fz-juelich.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 51F375397068B6D0369C1785777AF1DC7D787EBCD4B540D37701CEF5EBE925B9
    SPKI SHA256: 4C4347EFF107F482C5C01DAA8F43AE84ABFED3D988CAE036285C8DDFB6F00D7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### FZJ Certification Authority - G02

- Subject: countryName=DE, organizationName=Forschungszentrum Juelich GmbH, commonName=FZJ Certification Authority - G02, emailAddress=ca@fz-juelich.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249B7910DF
- SHA-256: 5FCBB1D93DC8D61137F4493F5CE8CEB2A66184210FE6828AC84AE70FEB721412
- SPKI SHA-256: 4C4347EFF107F482C5C01DAA8F43AE84ABFED3D988CAE036285C8DDFB6F00D7F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401598525663 (0x17a4249b7910df)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Forschungszentrum Juelich GmbH, CN = FZJ Certification Authority - G02, emailAddress = ca@fz-juelich.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                20:BD:71:89:A5:C9:2A:33:2F:11:E0:1F:E5:94:26:56:0F:11:02:25
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fz-juelich.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5FCBB1D93DC8D61137F4493F5CE8CEB2A66184210FE6828AC84AE70FEB721412
    SPKI SHA256: 4C4347EFF107F482C5C01DAA8F43AE84ABFED3D988CAE036285C8DDFB6F00D7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GEI CA - G01

- Subject: countryName=DE, organizationName=Georg-Eckert-Institut fuer internationale Schulbuchforschung, commonName=GEI CA - G01, emailAddress=ca@gei.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14B9FBAD84398C
- SHA-256: 47ED37AEB3F43A4368CEAF90862504B7C26963221158D47C8A60E2B9917A9593
- SPKI SHA-256: 38B8355EAFD53D7C98E615392FC3964BC3B87A81BDE1C64839AA542C9CF6D254
- Validity: 2012-11-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5833990133266828 (0x14b9fbad84398c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  7 15:28:29 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Georg-Eckert-Institut fuer internationale Schulbuchforschung, CN = GEI CA - G01, emailAddress = ca@gei.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CA:DF:FD:DD:89:6B:42:E4:0B:68:B2:99:EF:9A:08:CB:48:CB:4E:FD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@gei.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 47ED37AEB3F43A4368CEAF90862504B7C26963221158D47C8A60E2B9917A9593
    SPKI SHA256: 38B8355EAFD53D7C98E615392FC3964BC3B87A81BDE1C64839AA542C9CF6D254
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GEI CA - G01

- Subject: countryName=DE, organizationName=Georg-Eckert-Institut fuer internationale Schulbuchforschung, commonName=GEI CA - G01, emailAddress=ca@gei.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF70BCDE2F7
- SHA-256: E8981CD1A23C818F0F191B3F28E81396E6147BA8ABD9788DCC1ED9F106F84C72
- SPKI SHA-256: 38B8355EAFD53D7C98E615392FC3964BC3B87A81BDE1C64839AA542C9CF6D254
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400054170359 (0x17aff70bcde2f7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Georg-Eckert-Institut fuer internationale Schulbuchforschung, CN = GEI CA - G01, emailAddress = ca@gei.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CA:DF:FD:DD:89:6B:42:E4:0B:68:B2:99:EF:9A:08:CB:48:CB:4E:FD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@gei.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E8981CD1A23C818F0F191B3F28E81396E6147BA8ABD9788DCC1ED9F106F84C72
    SPKI SHA256: 38B8355EAFD53D7C98E615392FC3964BC3B87A81BDE1C64839AA542C9CF6D254
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GeoForschungsZentrum Potsdam CA - G01

- Subject: countryName=DE, organizationName=GeoForschungsZentrum Potsdam, commonName=GeoForschungsZentrum Potsdam CA - G01, emailAddress=pki@gfz-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906107BB7781
- SHA-256: E3EBD9DD79FE68B6BB308F8D189885C84B4BDFA5B62AD06966A1B9CAAAF77758
- SPKI SHA-256: 9662089D2DF2749F0D7CA81E2EB98D48E47E6034EFB9AFF928F4143008BD54E6
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670880298881 (0x17906107bb7781)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:32 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = GeoForschungsZentrum Potsdam, CN = GeoForschungsZentrum Potsdam CA - G01, emailAddress = pki@gfz-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9C:C8:A2:E5:9B:00:6C:CB:0E:A2:88:EB:A4:BA:6B:9F:B3:39:59:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@gfz-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E3EBD9DD79FE68B6BB308F8D189885C84B4BDFA5B62AD06966A1B9CAAAF77758
    SPKI SHA256: 9662089D2DF2749F0D7CA81E2EB98D48E47E6034EFB9AFF928F4143008BD54E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GeoForschungsZentrum Potsdam CA - G01

- Subject: countryName=DE, organizationName=GeoForschungsZentrum Potsdam, commonName=GeoForschungsZentrum Potsdam CA - G01, emailAddress=pki@gfz-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A2B1730
- SHA-256: 3C51C76BFEA9BEDD9F2B8679EE5099B247772C819E7DEB1D68BB84D80EC19EB8
- SPKI SHA-256: 9662089D2DF2749F0D7CA81E2EB98D48E47E6034EFB9AFF928F4143008BD54E6
- Validity: 2007-03-29 to 2019-03-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170596144 (0xa2b1730)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 29 10:49:06 2007 GMT
            Not After : Mar 28 00:00:00 2019 GMT
        Subject: C = DE, O = GeoForschungsZentrum Potsdam, CN = GeoForschungsZentrum Potsdam CA - G01, emailAddress = pki@gfz-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9C:C8:A2:E5:9B:00:6C:CB:0E:A2:88:EB:A4:BA:6B:9F:B3:39:59:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@gfz-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3C51C76BFEA9BEDD9F2B8679EE5099B247772C819E7DEB1D68BB84D80EC19EB8
    SPKI SHA256: 9662089D2DF2749F0D7CA81E2EB98D48E47E6034EFB9AFF928F4143008BD54E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GEOMAR CA - G02

- Subject: countryName=DE, organizationName=Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), commonName=GEOMAR CA - G02, emailAddress=ca@geomar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F68E858E
- SHA-256: B4EE1DB14F1563A6CE8EEEC0C35DECB1AFF9C919B00D3D85A12A6D430A965B21
- SPKI SHA-256: 20218E5F3E0CC1B9208D985978754F6E3DB12C66D58ED34E18094CE305CEDAB3
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399697696142 (0x17aff6f68e858e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:30 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), CN = GEOMAR CA - G02, emailAddress = ca@geomar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C5:71:F1:78:2D:AA:2E:83:46:46:C9:38:25:BB:E8:B7:53:EB:48:4A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@geomar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B4EE1DB14F1563A6CE8EEEC0C35DECB1AFF9C919B00D3D85A12A6D430A965B21
    SPKI SHA256: 20218E5F3E0CC1B9208D985978754F6E3DB12C66D58ED34E18094CE305CEDAB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GEOMAR CA - G02

- Subject: countryName=DE, organizationName=Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), commonName=GEOMAR CA - G02, emailAddress=ca@geomar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1296CEA64A9888
- SHA-256: 6F6BC1D4F51C0B4B92E8A55B7A888DA92BB8F596CB77A1D9F8ED8C4584EC55FF
- SPKI SHA-256: 20218E5F3E0CC1B9208D985978754F6E3DB12C66D58ED34E18094CE305CEDAB3
- Validity: 2011-09-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5232363878127752 (0x1296cea64a9888)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 19 14:26:31 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Helmholtz-Zentrum fuer Ozeanforschung Kiel (GEOMAR), CN = GEOMAR CA - G02, emailAddress = ca@geomar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C5:71:F1:78:2D:AA:2E:83:46:46:C9:38:25:BB:E8:B7:53:EB:48:4A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@geomar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6F6BC1D4F51C0B4B92E8A55B7A888DA92BB8F596CB77A1D9F8ED8C4584EC55FF
    SPKI SHA256: 20218E5F3E0CC1B9208D985978754F6E3DB12C66D58ED34E18094CE305CEDAB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GESIS-CA

- Subject: countryName=DE, organizationName=GESIS, organizationalUnitName=IT, commonName=GESIS-CA, emailAddress=gesis-ca@gesis.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF773E1394E
- SHA-256: 8D6369A057C1678088E51ADDA9AA73766D5A01C671DFEF314ED489D34B7739F1
- SPKI SHA-256: F97B046FB34699FF529B50AC4A4589034C6AAA1ECE17FC81849C420B71F321F4
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401800268110 (0x17aff773e1394e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = GESIS, OU = IT, CN = GESIS-CA, emailAddress = gesis-ca@gesis.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C0:1C:ED:6E:47:90:CA:1C:B2:A7:1B:DC:01:04:28:31:E4:AD:06:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gesis-ca@gesis.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8D6369A057C1678088E51ADDA9AA73766D5A01C671DFEF314ED489D34B7739F1
    SPKI SHA256: F97B046FB34699FF529B50AC4A4589034C6AAA1ECE17FC81849C420B71F321F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GESIS-CA

- Subject: countryName=DE, organizationName=GESIS, organizationalUnitName=IT, commonName=GESIS-CA, emailAddress=gesis-ca@gesis.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CAD1049
- SHA-256: 3C64E1CA16A6F26A331B56AC09B5DD009E052AD85B47B879613AF60B04A9E1D5
- SPKI SHA-256: F97B046FB34699FF529B50AC4A4589034C6AAA1ECE17FC81849C420B71F321F4
- Validity: 2008-07-28 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 212668489 (0xcad1049)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 28 09:34:49 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = GESIS, OU = IT, CN = GESIS-CA, emailAddress = gesis-ca@gesis.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C0:1C:ED:6E:47:90:CA:1C:B2:A7:1B:DC:01:04:28:31:E4:AD:06:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gesis-ca@gesis.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3C64E1CA16A6F26A331B56AC09B5DD009E052AD85B47B879613AF60B04A9E1D5
    SPKI SHA256: F97B046FB34699FF529B50AC4A4589034C6AAA1ECE17FC81849C420B71F321F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GKSS-CA G02

- Subject: countryName=DE, organizationName=GKSS Forschungszentrum, commonName=GKSS-CA G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C71A8BC
- SHA-256: 4EBA4E074D5F96BBE40A794B75CA07DC48D6ABACB58D40E9639FA150CDB882D3
- SPKI SHA-256: BDEF94E8FDBE5D057DAD3575D2B565BD66E0F66973F3FA506C7DC90A3A62123F
- Validity: 2008-06-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 208775356 (0xc71a8bc)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 13 08:09:17 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = GKSS Forschungszentrum, CN = GKSS-CA G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D5:81:41:14:EE:85:13:18:87:D3:6D:14:E5:DD:98:E0:24:EE:BF:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4EBA4E074D5F96BBE40A794B75CA07DC48D6ABACB58D40E9639FA150CDB882D3
    SPKI SHA256: BDEF94E8FDBE5D057DAD3575D2B565BD66E0F66973F3FA506C7DC90A3A62123F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Global-Uni-Ulm-CA

- Subject: countryName=DE, organizationName=Universitaet Ulm, commonName=Global-Uni-Ulm-CA, emailAddress=ca@uni-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF744EA6D8D
- SHA-256: B733CF597531BAF2099F2F24B506E1DD9AC74658727D2CE6B0AE759A83024F3F
- SPKI SHA-256: F1EEC2018C347FD9CA1986E468862E869CA4A044C2CC95C9357FD6411C739512
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401012342157 (0x17aff744ea6d8d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Ulm, CN = Global-Uni-Ulm-CA, emailAddress = ca@uni-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B3:7B:0F:3D:A3:87:B6:CF:64:ED:C2:76:5D:C2:DA:96:97:C9:A0:DF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B733CF597531BAF2099F2F24B506E1DD9AC74658727D2CE6B0AE759A83024F3F
    SPKI SHA256: F1EEC2018C347FD9CA1986E468862E869CA4A044C2CC95C9357FD6411C739512
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Global-Uni-Ulm-CA

- Subject: countryName=DE, organizationName=Universitaet Ulm, commonName=Global-Uni-Ulm-CA, emailAddress=ca@uni-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F335D03
- SHA-256: 5BF13E91C84FB4DD2595A55EA92974DE98DCC42424B11812758B1A438E937FA5
- SPKI SHA-256: F1EEC2018C347FD9CA1986E468862E869CA4A044C2CC95C9357FD6411C739512
- Validity: 2009-11-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 255024387 (0xf335d03)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 30 15:06:28 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Ulm, CN = Global-Uni-Ulm-CA, emailAddress = ca@uni-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B3:7B:0F:3D:A3:87:B6:CF:64:ED:C2:76:5D:C2:DA:96:97:C9:A0:DF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5BF13E91C84FB4DD2595A55EA92974DE98DCC42424B11812758B1A438E937FA5
    SPKI SHA256: F1EEC2018C347FD9CA1986E468862E869CA4A044C2CC95C9357FD6411C739512
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Global-UNITUE-CA 01

- Subject: countryName=DE, organizationName=Universitaet Tuebingen, commonName=Global-UNITUE-CA 01, emailAddress=unitue-ca@uni-tuebingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6A000
- SHA-256: 42F08177626E30116CE9A12ABCFA936E70AB760F31996BA4669596AF6BCA762A
- SPKI SHA-256: 5635E432C4579CB12E00B24DC69F87E931621F1FE748E33EAE9F9805000AE1A7
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166109184 (0x9e6a000)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 12:26:26 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Tuebingen, CN = Global-UNITUE-CA 01, emailAddress = unitue-ca@uni-tuebingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B0:C1:BB:68:35:7F:E2:D6:41:9C:1A:71:AF:E0:FC:41:34:CD:C3:A8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unitue-ca@uni-tuebingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 42F08177626E30116CE9A12ABCFA936E70AB760F31996BA4669596AF6BCA762A
    SPKI SHA256: 5635E432C4579CB12E00B24DC69F87E931621F1FE748E33EAE9F9805000AE1A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Global-UNITUE-CA 01

- Subject: countryName=DE, organizationName=Universitaet Tuebingen, commonName=Global-UNITUE-CA 01, emailAddress=unitue-ca@uni-tuebingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D7B4E511
- SHA-256: 780DC84A208601FAF90A7897616EA111DA536C8456451DC0FE0F36981B014A93
- SPKI SHA-256: 5635E432C4579CB12E00B24DC69F87E931621F1FE748E33EAE9F9805000AE1A7
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670074561809 (0x179060d7b4e511)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:43 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Tuebingen, CN = Global-UNITUE-CA 01, emailAddress = unitue-ca@uni-tuebingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B0:C1:BB:68:35:7F:E2:D6:41:9C:1A:71:AF:E0:FC:41:34:CD:C3:A8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unitue-ca@uni-tuebingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 780DC84A208601FAF90A7897616EA111DA536C8456451DC0FE0F36981B014A93
    SPKI SHA256: 5635E432C4579CB12E00B24DC69F87E931621F1FE748E33EAE9F9805000AE1A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GRS CA

- Subject: countryName=DE, organizationName=Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, commonName=GRS CA, emailAddress=pki@grs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 11B502CB
- SHA-256: B9FCCEA0F23D1507C7A2D31A44932D9182ED57B3D5DB39ADDC2BF3903C079BBD
- SPKI SHA-256: 363E086DB4D1F120A7640E39148BAA72B87CD368E4687B05B35A8654A0EF0788
- Validity: 2011-04-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 297075403 (0x11b502cb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  1 07:56:43 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, CN = GRS CA, emailAddress = pki@grs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BE:AF:FE:FF:CE:BB:AF:7F:C1:3B:F5:89:31:C1:86:43:F9:16:49:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@grs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B9FCCEA0F23D1507C7A2D31A44932D9182ED57B3D5DB39ADDC2BF3903C079BBD
    SPKI SHA256: 363E086DB4D1F120A7640E39148BAA72B87CD368E4687B05B35A8654A0EF0788
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GRS CA

- Subject: countryName=DE, organizationName=Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, commonName=GRS CA, emailAddress=pki@grs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F07B5FA9
- SHA-256: 94A7D9B4A764076E6210DB60B1A84434F2BE7B6BB5EB21E1B145DA0840E08650
- SPKI SHA-256: 363E086DB4D1F120A7640E39148BAA72B87CD368E4687B05B35A8654A0EF0788
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399595777961 (0x17aff6f07b5fa9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:24 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, CN = GRS CA, emailAddress = pki@grs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BE:AF:FE:FF:CE:BB:AF:7F:C1:3B:F5:89:31:C1:86:43:F9:16:49:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@grs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 94A7D9B4A764076E6210DB60B1A84434F2BE7B6BB5EB21E1B145DA0840E08650
    SPKI SHA256: 363E086DB4D1F120A7640E39148BAA72B87CD368E4687B05B35A8654A0EF0788
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GSI CA 02

- Subject: countryName=DE, organizationName=Gesellschaft fuer Schwerionenforschung mbH (GSI), organizationalUnitName=GF/W, commonName=GSI CA 02, emailAddress=pki@gsi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424AECB784B
- SHA-256: C90893D82C5438DA588DAEE5E996A63F3342537C6B535C8AE0773FD7BC3BA276
- SPKI SHA-256: 707A2B1D88E61BBF65979FEC43ADEDD19C24DB52D8595C4C25161EA0D0A83A09
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401922693195 (0x17a424aecb784b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:22 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Gesellschaft fuer Schwerionenforschung mbH (GSI), OU = GF/W, CN = GSI CA 02, emailAddress = pki@gsi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EF:1D:71:5C:91:A1:71:A3:D1:46:C1:08:BE:4E:75:8E:14:38:F4:AF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@gsi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C90893D82C5438DA588DAEE5E996A63F3342537C6B535C8AE0773FD7BC3BA276
    SPKI SHA256: 707A2B1D88E61BBF65979FEC43ADEDD19C24DB52D8595C4C25161EA0D0A83A09
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GSI CA 02

- Subject: countryName=DE, organizationName=Gesellschaft fuer Schwerionenforschung mbH (GSI), organizationalUnitName=GF/W, commonName=GSI CA 02, emailAddress=pki@gsi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE63238
- SHA-256: 5567A5752EE08F1A454F770EE9E9308BB0028FBEF89548F5B1D294D136C30AC9
- SPKI SHA-256: 707A2B1D88E61BBF65979FEC43ADEDD19C24DB52D8595C4C25161EA0D0A83A09
- Validity: 2008-02-28 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199635512 (0xbe63238)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 28 13:18:34 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Gesellschaft fuer Schwerionenforschung mbH (GSI), OU = GF/W, CN = GSI CA 02, emailAddress = pki@gsi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EF:1D:71:5C:91:A1:71:A3:D1:46:C1:08:BE:4E:75:8E:14:38:F4:AF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@gsi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5567A5752EE08F1A454F770EE9E9308BB0028FBEF89548F5B1D294D136C30AC9
    SPKI SHA256: 707A2B1D88E61BBF65979FEC43ADEDD19C24DB52D8595C4C25161EA0D0A83A09
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GWDG CA

- Subject: countryName=DE, stateOrProvinceName=NIEDERSACHSEN, localityName=GOETTINGEN, organizationName=Gesellschaft fuer wissenschaftliche Datenverarbeitung, organizationalUnitName=GWDG, commonName=GWDG CA, emailAddress=gwdg-ca@gwdg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A04CDDD
- SHA-256: 6C3ADA21C961437E36788A38D46C8F663E9E08379EC7129EE0201734F4A49368
- SPKI SHA-256: 4700A1337CFC3BF6B00F262A75590693D4A86604FEABD705E4C0B8EF86E675BE
- Validity: 2007-02-28 to 2019-02-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168087005 (0xa04cddd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 28 09:50:07 2007 GMT
            Not After : Feb 27 00:00:00 2019 GMT
        Subject: C = DE, ST = NIEDERSACHSEN, L = GOETTINGEN, O = Gesellschaft fuer wissenschaftliche Datenverarbeitung, OU = GWDG, CN = GWDG CA, emailAddress = gwdg-ca@gwdg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A6:E4:FF:98:FD:E5:49:32:7E:5C:75:F2:16:A2:4D:8C:74:35:DE:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gwdg-ca@gwdg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6C3ADA21C961437E36788A38D46C8F663E9E08379EC7129EE0201734F4A49368
    SPKI SHA256: 4700A1337CFC3BF6B00F262A75590693D4A86604FEABD705E4C0B8EF86E675BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GWDG CA

- Subject: countryName=DE, stateOrProvinceName=NIEDERSACHSEN, localityName=GOETTINGEN, organizationName=Gesellschaft fuer wissenschaftliche Datenverarbeitung, organizationalUnitName=GWDG, commonName=GWDG CA, emailAddress=gwdg-ca@gwdg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060EC3B68AD
- SHA-256: 57C446785934052D81F64438EE4DC00D34FCB0CC3937964CA48ACCCECE8C40E0
- SPKI SHA-256: 4700A1337CFC3BF6B00F262A75590693D4A86604FEABD705E4C0B8EF86E675BE
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670418921645 (0x179060ec3b68ad)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:04 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = NIEDERSACHSEN, L = GOETTINGEN, O = Gesellschaft fuer wissenschaftliche Datenverarbeitung, OU = GWDG, CN = GWDG CA, emailAddress = gwdg-ca@gwdg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A6:E4:FF:98:FD:E5:49:32:7E:5C:75:F2:16:A2:4D:8C:74:35:DE:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gwdg-ca@gwdg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 57C446785934052D81F64438EE4DC00D34FCB0CC3937964CA48ACCCECE8C40E0
    SPKI SHA256: 4700A1337CFC3BF6B00F262A75590693D4A86604FEABD705E4C0B8EF86E675BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAB CA - G01

- Subject: countryName=DE, organizationName=Herzog August Bibliothek Wolfenbuettel, commonName=HAB CA - G01, emailAddress=ca@hab.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7114000D0
- SHA-256: 1454A90CB3602B4E1E76DFB1599164C034A705C742460754AD8F05461372FE0E
- SPKI SHA-256: 0D4EC3D191EB4756E03D95C25393C2EAB4A440F11BC924A050806CE8B5D4C9D9
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400145535184 (0x17aff7114000d0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Herzog August Bibliothek Wolfenbuettel, CN = HAB CA - G01, emailAddress = ca@hab.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2C:C6:1B:F0:6E:3B:DD:D9:0A:A5:5B:BE:23:7F:17:B6:A2:64:DC:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hab.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1454A90CB3602B4E1E76DFB1599164C034A705C742460754AD8F05461372FE0E
    SPKI SHA256: 0D4EC3D191EB4756E03D95C25393C2EAB4A440F11BC924A050806CE8B5D4C9D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAB CA - G01

- Subject: countryName=DE, organizationName=Herzog August Bibliothek Wolfenbuettel, commonName=HAB CA - G01, emailAddress=ca@hab.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14E94DB9BE2D61
- SHA-256: 9979434CE5FA098FA8D1A966A6384558D4E6C35C94613ED52A4A4634E70AEEC9
- SPKI SHA-256: 0D4EC3D191EB4756E03D95C25393C2EAB4A440F11BC924A050806CE8B5D4C9D9
- Validity: 2012-12-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5886019572215137 (0x14e94db9be2d61)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 13 12:55:05 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Herzog August Bibliothek Wolfenbuettel, CN = HAB CA - G01, emailAddress = ca@hab.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2C:C6:1B:F0:6E:3B:DD:D9:0A:A5:5B:BE:23:7F:17:B6:A2:64:DC:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hab.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9979434CE5FA098FA8D1A966A6384558D4E6C35C94613ED52A4A4634E70AEEC9
    SPKI SHA256: 0D4EC3D191EB4756E03D95C25393C2EAB4A440F11BC924A050806CE8B5D4C9D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HafenCity Universitaet Hamburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=HafenCity Universitaet Hamburg, commonName=HafenCity Universitaet Hamburg CA - G01, emailAddress=pki@hcu-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B89EFA3
- SHA-256: AE07FBABB804BC06A055AD2377D2AA7A9B5D5B8424C0E5B0775573071A01CEAC
- SPKI SHA-256: EF6149F1A605D568CF264A4FBC06F9D0C63B75EA4E076995537A2ED82A267EF3
- Validity: 2007-12-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193589155 (0xb89efa3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 20 13:45:57 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = HafenCity Universitaet Hamburg, CN = HafenCity Universitaet Hamburg CA - G01, emailAddress = pki@hcu-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                DA:05:49:EE:51:E9:16:39:6A:11:5E:3C:AA:2D:56:3C:30:29:B1:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hcu-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AE07FBABB804BC06A055AD2377D2AA7A9B5D5B8424C0E5B0775573071A01CEAC
    SPKI SHA256: EF6149F1A605D568CF264A4FBC06F9D0C63B75EA4E076995537A2ED82A267EF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HafenCity Universitaet Hamburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=HafenCity Universitaet Hamburg, commonName=HafenCity Universitaet Hamburg CA - G01, emailAddress=pki@hcu-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249C264564
- SHA-256: E5BE994B8E3903602666361A1E7D87482438C2747669625EB80A2935DD4EA270
- SPKI SHA-256: EF6149F1A605D568CF264A4FBC06F9D0C63B75EA4E076995537A2ED82A267EF3
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401609876836 (0x17a4249c264564)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:05 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = HafenCity Universitaet Hamburg, CN = HafenCity Universitaet Hamburg CA - G01, emailAddress = pki@hcu-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DA:05:49:EE:51:E9:16:39:6A:11:5E:3C:AA:2D:56:3C:30:29:B1:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hcu-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E5BE994B8E3903602666361A1E7D87482438C2747669625EB80A2935DD4EA270
    SPKI SHA256: EF6149F1A605D568CF264A4FBC06F9D0C63B75EA4E076995537A2ED82A267EF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAW Hamburg CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Angewandte Wissenschaften Hamburg, commonName=HAW Hamburg CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D0CA704C
- SHA-256: 7B0500AE1A5C6C2A0EE6815F3E9210690E184CC8AA250A11F94D59CC7D5583F8
- SPKI SHA-256: 0758E5CB7179E0178C2E57ACCF35E9A456BB1C40D0F1D29ADD5AF82EABB0DE2B
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669958533196 (0x179060d0ca704c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Angewandte Wissenschaften Hamburg, CN = HAW Hamburg CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6C:56:C5:49:95:AD:BF:25:CE:4E:34:25:3F:C0:EF:8F:F9:AF:4E:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7B0500AE1A5C6C2A0EE6815F3E9210690E184CC8AA250A11F94D59CC7D5583F8
    SPKI SHA256: 0758E5CB7179E0178C2E57ACCF35E9A456BB1C40D0F1D29ADD5AF82EABB0DE2B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAW Hamburg CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Angewandte Wissenschaften Hamburg, commonName=HAW Hamburg CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DD669D
- SHA-256: D57E95D142125A358CE05BEB34923145D4E892510A6A307F3D851EE177B81621
- SPKI SHA-256: 0758E5CB7179E0178C2E57ACCF35E9A456BB1C40D0F1D29ADD5AF82EABB0DE2B
- Validity: 2007-01-29 to 2019-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165504669 (0x9dd669d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 29 12:31:11 2007 GMT
            Not After : Jan 28 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Angewandte Wissenschaften Hamburg, CN = HAW Hamburg CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6C:56:C5:49:95:AD:BF:25:CE:4E:34:25:3F:C0:EF:8F:F9:AF:4E:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D57E95D142125A358CE05BEB34923145D4E892510A6A307F3D851EE177B81621
    SPKI SHA256: 0758E5CB7179E0178C2E57ACCF35E9A456BB1C40D0F1D29ADD5AF82EABB0DE2B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HAW Ingolstadt CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Hochschule fuer angewandte Wissenschaften FH Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=HAW Ingolstadt CA - G01, emailAddress=pki@haw-ingolstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F87AF37
- SHA-256: 811DE754925E985A295297478191F08EE9ED8B31F703927A0959FAECD12E3EEC
- SPKI SHA-256: D75E3D70965555527B1B4FC1C6D7B1B63C5F688ECA8961B01CF552F1FEB8DAFE
- Validity: 2010-02-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 260550455 (0xf87af37)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  2 14:07:36 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ingolstadt, O = Hochschule fuer angewandte Wissenschaften FH Ingolstadt, OU = Rechenzentrum, CN = HAW Ingolstadt CA - G01, emailAddress = pki@haw-ingolstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                63:2C:2F:02:29:52:FA:CF:AB:1A:F2:A8:12:8B:CD:AD:BE:59:F6:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@haw-ingolstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 811DE754925E985A295297478191F08EE9ED8B31F703927A0959FAECD12E3EEC
    SPKI SHA256: D75E3D70965555527B1B4FC1C6D7B1B63C5F688ECA8961B01CF552F1FEB8DAFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HAW Ingolstadt CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ingolstadt, organizationName=Hochschule fuer angewandte Wissenschaften FH Ingolstadt, organizationalUnitName=Rechenzentrum, commonName=HAW Ingolstadt CA - G01, emailAddress=pki@haw-ingolstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6CFEF5F3E
- SHA-256: 3D59B47C9F0623B19320408E25AEE25DBE0FEB4CCE66B6A2EC871038BFC2435D
- SPKI SHA-256: D75E3D70965555527B1B4FC1C6D7B1B63C5F688ECA8961B01CF552F1FEB8DAFE
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399049731902 (0x17aff6cfef5f3e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ingolstadt, O = Hochschule fuer angewandte Wissenschaften FH Ingolstadt, OU = Rechenzentrum, CN = HAW Ingolstadt CA - G01, emailAddress = pki@haw-ingolstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                63:2C:2F:02:29:52:FA:CF:AB:1A:F2:A8:12:8B:CD:AD:BE:59:F6:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@haw-ingolstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3D59B47C9F0623B19320408E25AEE25DBE0FEB4CCE66B6A2EC871038BFC2435D
    SPKI SHA256: D75E3D70965555527B1B4FC1C6D7B1B63C5F688ECA8961B01CF552F1FEB8DAFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAW-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Amberg, organizationName=Hochschule Amberg-Weiden, organizationalUnitName=Rechenzentrum, commonName=HAW-CA, emailAddress=ca@haw-aw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0EE57D74
- SHA-256: E5AF1F3AAC09618442A47A3D6E0172F6C8BA274305694FD198DE89F4D0BFAE7C
- SPKI SHA-256: AFDCCAEF0533417ABDA570F32CEA4CDBF0C9B84835BAC6196B563036E7BFD1BF
- Validity: 2009-10-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 249920884 (0xee57d74)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  2 13:28:04 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Amberg, O = Hochschule Amberg-Weiden, OU = Rechenzentrum, CN = HAW-CA, emailAddress = ca@haw-aw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                33:AC:1D:C6:56:0F:E1:1B:01:AA:0C:89:8E:D6:D6:E7:55:F5:A1:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@haw-aw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E5AF1F3AAC09618442A47A3D6E0172F6C8BA274305694FD198DE89F4D0BFAE7C
    SPKI SHA256: AFDCCAEF0533417ABDA570F32CEA4CDBF0C9B84835BAC6196B563036E7BFD1BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HAW-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Amberg, organizationName=Hochschule Amberg-Weiden, organizationalUnitName=Rechenzentrum, commonName=HAW-CA, emailAddress=ca@haw-aw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF748510F32
- SHA-256: 93C6C1BCE558290A3426021E520D6DD5785D680ACB0DA70903E4856546D386CC
- SPKI SHA-256: AFDCCAEF0533417ABDA570F32CEA4CDBF0C9B84835BAC6196B563036E7BFD1BF
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401069399858 (0x17aff748510f32)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Amberg, O = Hochschule Amberg-Weiden, OU = Rechenzentrum, CN = HAW-CA, emailAddress = ca@haw-aw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:AC:1D:C6:56:0F:E1:1B:01:AA:0C:89:8E:D6:D6:E7:55:F5:A1:61
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@haw-aw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 93C6C1BCE558290A3426021E520D6DD5785D680ACB0DA70903E4856546D386CC
    SPKI SHA256: AFDCCAEF0533417ABDA570F32CEA4CDBF0C9B84835BAC6196B563036E7BFD1BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HAWK-HHG-CA - G02

- Subject: countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A874244
- SHA-256: 8A2325C5754FB4A36BCA28A62729DE8659978DFE3B96E1E40981A7B0108BDA08
- SPKI SHA-256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 176636484 (0xa874244)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 13:26:00 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, OU = Rechenzentrum, CN = HAWK-HHG-CA - G02, emailAddress = rechenzentrum@hawk-hhg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                48:0A:0B:39:5A:A7:F1:81:42:2B:75:81:1B:0F:3C:D4:26:3F:3F:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rechenzentrum@hawk-hhg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8A2325C5754FB4A36BCA28A62729DE8659978DFE3B96E1E40981A7B0108BDA08
    SPKI SHA256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HAWK-HHG-CA - G02

- Subject: countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6A01D
- SHA-256: FDE7ADC45AFE9F6F0DD3EC860F7E3423C234FED5F08A0E287E622954D58BDD25
- SPKI SHA-256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166109213 (0x9e6a01d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 12:26:55 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, OU = Rechenzentrum, CN = HAWK-HHG-CA - G02, emailAddress = rechenzentrum@hawk-hhg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                48:0A:0B:39:5A:A7:F1:81:42:2B:75:81:1B:0F:3C:D4:26:3F:3F:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rechenzentrum@hawk-hhg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FDE7ADC45AFE9F6F0DD3EC860F7E3423C234FED5F08A0E287E622954D58BDD25
    SPKI SHA256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HAWK-HHG-CA - G02

- Subject: countryName=DE, organizationName=HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, organizationalUnitName=Rechenzentrum, commonName=HAWK-HHG-CA - G02, emailAddress=rechenzentrum@hawk-hhg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424760A21DE
- SHA-256: 7287009BAEC5B21DA259407A3A20DFA36CA63C45B35B43249C073B27D0FD9810
- SPKI SHA-256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
- Validity: 2007-02-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400970498526 (0x17a424760a21de)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 13:26:00 2007 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = HAWK Fachhochschule Hildesheim/Holzminden/Goettingen, OU = Rechenzentrum, CN = HAWK-HHG-CA - G02, emailAddress = rechenzentrum@hawk-hhg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                48:0A:0B:39:5A:A7:F1:81:42:2B:75:81:1B:0F:3C:D4:26:3F:3F:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rechenzentrum@hawk-hhg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7287009BAEC5B21DA259407A3A20DFA36CA63C45B35B43249C073B27D0FD9810
    SPKI SHA256: 1DC0D9B1DD79B2AA2F2E7283BC74571985921F389F10CC86F163836495AE3A6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HBC-Global CA - G 01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Biberach, organizationName=Hochschule Biberach, organizationalUnitName=Rechenzentrum, commonName=HBC-Global CA - G 01, emailAddress=pki@fh-biberach.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C252F69
- SHA-256: BF6F81EBABE4BDFA5289057C9C0C6192A090329552334EFBC5274F7967ECF928
- SPKI SHA-256: 5209874087313DF556BD55A85BA5A3D2A11B7FF872355D5C0E7861EDFF8AB8D0
- Validity: 2008-04-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 203763561 (0xc252f69)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 16 07:59:22 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Biberach, O = Hochschule Biberach, OU = Rechenzentrum, CN = HBC-Global CA - G 01, emailAddress = pki@fh-biberach.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                91:10:14:78:18:80:FD:DB:0C:F0:96:51:CA:B8:44:33:DC:49:48:4D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-biberach.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BF6F81EBABE4BDFA5289057C9C0C6192A090329552334EFBC5274F7967ECF928
    SPKI SHA256: 5209874087313DF556BD55A85BA5A3D2A11B7FF872355D5C0E7861EDFF8AB8D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HBC-Global CA - G 01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Biberach, organizationName=Hochschule Biberach, organizationalUnitName=Rechenzentrum, commonName=HBC-Global CA - G 01, emailAddress=pki@fh-biberach.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B8EEC350
- SHA-256: 48B215DC41DBDEA35E3076024D4286F2301EAFE183F9AFF9387CAA6EAD25D431
- SPKI SHA-256: 5209874087313DF556BD55A85BA5A3D2A11B7FF872355D5C0E7861EDFF8AB8D0
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402092778320 (0x17a424b8eec350)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:32 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Biberach, O = Hochschule Biberach, OU = Rechenzentrum, CN = HBC-Global CA - G 01, emailAddress = pki@fh-biberach.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                91:10:14:78:18:80:FD:DB:0C:F0:96:51:CA:B8:44:33:DC:49:48:4D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-biberach.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 48B215DC41DBDEA35E3076024D4286F2301EAFE183F9AFF9387CAA6EAD25D431
    SPKI SHA256: 5209874087313DF556BD55A85BA5A3D2A11B7FF872355D5C0E7861EDFF8AB8D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### hbz NRW CA - G02

- Subject: countryName=DE, organizationName=Hochschulbibliothekszentrum NRW, organizationalUnitName=Rechenzentrum, commonName=hbz NRW CA - G02, emailAddress=pki@hbz-nrw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A972424
- SHA-256: 71FF0F4C48FC4E2D68CA6070DF0236319213FC1E7E465C7705326947BB2B2C4E
- SPKI SHA-256: EE31C795641CA3D0AEAF5B33E602FBD17DA50C6A5170459AAB7F9272AB87BE34
- Validity: 2007-06-19 to 2019-06-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677348 (0xa972424)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:49:09 2007 GMT
            Not After : Jun 18 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschulbibliothekszentrum NRW, OU = Rechenzentrum, CN = hbz NRW CA - G02, emailAddress = pki@hbz-nrw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B5:FD:11:7C:DD:5C:ED:27:CE:C5:99:16:F2:37:2A:D6:33:20:2F:FA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hbz-nrw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 71FF0F4C48FC4E2D68CA6070DF0236319213FC1E7E465C7705326947BB2B2C4E
    SPKI SHA256: EE31C795641CA3D0AEAF5B33E602FBD17DA50C6A5170459AAB7F9272AB87BE34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### hbz NRW CA - G02

- Subject: countryName=DE, organizationName=Hochschulbibliothekszentrum NRW, organizationalUnitName=Rechenzentrum, commonName=hbz NRW CA - G02, emailAddress=pki@hbz-nrw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42478605B0A
- SHA-256: 8901BD9960FD5AA55915E0E8A3AFC44584EAAAA22F8EF377DF22646BAC4B4466
- SPKI SHA-256: EE31C795641CA3D0AEAF5B33E602FBD17DA50C6A5170459AAB7F9272AB87BE34
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401009703690 (0x17a42478605b0a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:28 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschulbibliothekszentrum NRW, OU = Rechenzentrum, CN = hbz NRW CA - G02, emailAddress = pki@hbz-nrw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B5:FD:11:7C:DD:5C:ED:27:CE:C5:99:16:F2:37:2A:D6:33:20:2F:FA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hbz-nrw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8901BD9960FD5AA55915E0E8A3AFC44584EAAAA22F8EF377DF22646BAC4B4466
    SPKI SHA256: EE31C795641CA3D0AEAF5B33E602FBD17DA50C6A5170459AAB7F9272AB87BE34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HE CA - G02

- Subject: countryName=DE, organizationName=Hochschule Esslingen, organizationalUnitName=Rechenzentrum, commonName=HE CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610D2DC32B
- SHA-256: 6EE5ACCC5A02D70B84C78E452C36292A6ADE4978C54CA50B35BA2F2924CA7C76
- SPKI SHA-256: EFC090D76B17AE9372321B2304B776DE926151641DD9BFBC2DF0915810A26F08
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670971675435 (0x1790610d2dc32b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Esslingen, OU = Rechenzentrum, CN = HE CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E3:5B:17:BC:D6:2C:32:65:32:40:DD:4D:17:C0:37:DE:3A:4D:5F:5C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6EE5ACCC5A02D70B84C78E452C36292A6ADE4978C54CA50B35BA2F2924CA7C76
    SPKI SHA256: EFC090D76B17AE9372321B2304B776DE926151641DD9BFBC2DF0915810A26F08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HE CA - G02

- Subject: countryName=DE, organizationName=Hochschule Esslingen, organizationalUnitName=Rechenzentrum, commonName=HE CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC79
- SHA-256: 9AA4CD55BA4E9488079D31F3C2E0023DBEC73488806506FABE2438B9386496F8
- SPKI SHA-256: EFC090D76B17AE9372321B2304B776DE926151641DD9BFBC2DF0915810A26F08
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027577 (0xa31ac79)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:38 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Esslingen, OU = Rechenzentrum, CN = HE CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E3:5B:17:BC:D6:2C:32:65:32:40:DD:4D:17:C0:37:DE:3A:4D:5F:5C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9AA4CD55BA4E9488079D31F3C2E0023DBEC73488806506FABE2438B9386496F8
    SPKI SHA256: EFC090D76B17AE9372321B2304B776DE926151641DD9BFBC2DF0915810A26F08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Helmholtz Zentrum Muenchen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Oberschleissheim-Neuherberg, organizationName=Helmholtz Zentrum Muenchen, organizationalUnitName=Rechenzentrum, commonName=Helmholtz Zentrum Muenchen CA - G01, emailAddress=pki@helmholtz-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A26556AC
- SHA-256: 5992EF8C1A5FEF9BC89B0C00F62BE06AE98410092F8A31C83541B206A1D0DFB6
- SPKI SHA-256: 1699840AE8E7804FC529C6E7E9AE3BFF3E12C85DBC911FE000EE0C48ECDC9058
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401714673324 (0x17a424a26556ac)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:10 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Oberschleissheim-Neuherberg, O = Helmholtz Zentrum Muenchen, OU = Rechenzentrum, CN = Helmholtz Zentrum Muenchen CA - G01, emailAddress = pki@helmholtz-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3F:34:D3:FC:09:BE:08:B4:27:F6:D2:B4:F3:F6:52:65:0A:9C:DB:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@helmholtz-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5992EF8C1A5FEF9BC89B0C00F62BE06AE98410092F8A31C83541B206A1D0DFB6
    SPKI SHA256: 1699840AE8E7804FC529C6E7E9AE3BFF3E12C85DBC911FE000EE0C48ECDC9058
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Helmholtz Zentrum Muenchen CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Oberschleissheim-Neuherberg, organizationName=Helmholtz Zentrum Muenchen, organizationalUnitName=Rechenzentrum, commonName=Helmholtz Zentrum Muenchen CA - G01, emailAddress=pki@helmholtz-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BA56EEE
- SHA-256: 04B0F29F6C675AFD747DC7E544EFACD151971A2E5AB90C5549B80759DE2E0C85
- SPKI SHA-256: 1699840AE8E7804FC529C6E7E9AE3BFF3E12C85DBC911FE000EE0C48ECDC9058
- Validity: 2008-01-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 195391214 (0xba56eee)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 10 10:20:16 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Oberschleissheim-Neuherberg, O = Helmholtz Zentrum Muenchen, OU = Rechenzentrum, CN = Helmholtz Zentrum Muenchen CA - G01, emailAddress = pki@helmholtz-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3F:34:D3:FC:09:BE:08:B4:27:F6:D2:B4:F3:F6:52:65:0A:9C:DB:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@helmholtz-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 04B0F29F6C675AFD747DC7E544EFACD151971A2E5AB90C5549B80759DE2E0C85
    SPKI SHA256: 1699840AE8E7804FC529C6E7E9AE3BFF3E12C85DBC911FE000EE0C48ECDC9058
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Helmholtz-Zentrum fuer Infektionsforschung

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Helmholtz-Zentrum fuer Infektionsforschung GmbH, organizationalUnitName=Rechenzentrum, commonName=Helmholtz-Zentrum fuer Infektionsforschung, emailAddress=sysadmin@helmholtz-hzi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AA2FAFB
- SHA-256: C5B8C59808888C98B4A0DE7371B941909F5CE2C8DE5836845B667399C1F3EB4B
- SPKI SHA-256: F8E51A73255D514E2CFEFDF8238AA1341B5D34B33BCC5AEA5959B706250CD040
- Validity: 2007-06-28 to 2019-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 178453243 (0xaa2fafb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 28 09:20:45 2007 GMT
            Not After : Jun 27 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Helmholtz-Zentrum fuer Infektionsforschung GmbH, OU = Rechenzentrum, CN = Helmholtz-Zentrum fuer Infektionsforschung, emailAddress = sysadmin@helmholtz-hzi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D1:9E:32:27:A7:78:FF:6E:20:31:5A:DC:8F:B9:AE:FF:AF:0B:1C:BF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:sysadmin@helmholtz-hzi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C5B8C59808888C98B4A0DE7371B941909F5CE2C8DE5836845B667399C1F3EB4B
    SPKI SHA256: F8E51A73255D514E2CFEFDF8238AA1341B5D34B33BCC5AEA5959B706250CD040
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Helmholtz-Zentrum fuer Infektionsforschung

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Helmholtz-Zentrum fuer Infektionsforschung GmbH, organizationalUnitName=Rechenzentrum, commonName=Helmholtz-Zentrum fuer Infektionsforschung, emailAddress=sysadmin@helmholtz-hzi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247E044344
- SHA-256: F39853F0F2134FA0B659D8E17E15E70D856374C67FC85D60D49BBDBE70BA987A
- SPKI SHA-256: F8E51A73255D514E2CFEFDF8238AA1341B5D34B33BCC5AEA5959B706250CD040
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401104331588 (0x17a4247e044344)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:34 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Helmholtz-Zentrum fuer Infektionsforschung GmbH, OU = Rechenzentrum, CN = Helmholtz-Zentrum fuer Infektionsforschung, emailAddress = sysadmin@helmholtz-hzi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D1:9E:32:27:A7:78:FF:6E:20:31:5A:DC:8F:B9:AE:FF:AF:0B:1C:BF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:sysadmin@helmholtz-hzi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F39853F0F2134FA0B659D8E17E15E70D856374C67FC85D60D49BBDBE70BA987A
    SPKI SHA256: F8E51A73255D514E2CFEFDF8238AA1341B5D34B33BCC5AEA5959B706250CD040
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, organizationalUnitName=WKDV, commonName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress=wkdv-pki@ufz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE4D2EB
- SHA-256: 2A0B704DBEE7CA2F297E36D53DAEE5D4C63A418F36A17D21695FF279BD9CA333
- SPKI SHA-256: 7BD221531F30B94796BA8633E316A83C5BF29F77DAFF4A7F2CEA3C7B2C2FA9A0
- Validity: 2008-02-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199545579 (0xbe4d2eb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 27 12:19:40 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, OU = WKDV, CN = Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress = wkdv-pki@ufz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:C1:27:A0:EA:EB:30:EB:67:9A:1B:CD:A8:D2:31:C6:34:C1:9E:A8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:wkdv-pki@ufz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2A0B704DBEE7CA2F297E36D53DAEE5D4C63A418F36A17D21695FF279BD9CA333
    SPKI SHA256: 7BD221531F30B94796BA8633E316A83C5BF29F77DAFF4A7F2CEA3C7B2C2FA9A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, organizationalUnitName=WKDV, commonName=Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress=wkdv-pki@ufz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424ADA0F7B1
- SHA-256: 0D2DB3873E90F1CD8F2F20D3A44579F85B435F12DBF81F240299984795401AA8
- SPKI SHA-256: 7BD221531F30B94796BA8633E316A83C5BF29F77DAFF4A7F2CEA3C7B2C2FA9A0
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401903130545 (0x17a424ada0f7b1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:21 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ, OU = WKDV, CN = Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ CA - G01, emailAddress = wkdv-pki@ufz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:C1:27:A0:EA:EB:30:EB:67:9A:1B:CD:A8:D2:31:C6:34:C1:9E:A8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:wkdv-pki@ufz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0D2DB3873E90F1CD8F2F20D3A44579F85B435F12DBF81F240299984795401AA8
    SPKI SHA256: 7BD221531F30B94796BA8633E316A83C5BF29F77DAFF4A7F2CEA3C7B2C2FA9A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HFK-BREMEN-CA

- Subject: countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Hochschule fuer Kuenste Bremen, commonName=HFK-BREMEN-CA, emailAddress=hotline@hfk-bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DE9AA4A
- SHA-256: FC21A0A04BABBDF32A545B730672E715C801C048596060435B5579B433CF62B7
- SPKI SHA-256: 84754B93B82B9EBF2DE3F02FCB67F72484AFF22B0C864FD0430DB4A630A0A07B
- Validity: 2009-03-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 233417290 (0xde9aa4a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 25 13:08:11 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bremen, L = Bremen, O = Hochschule fuer Kuenste Bremen, CN = HFK-BREMEN-CA, emailAddress = hotline@hfk-bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:25:8B:7D:C6:EB:1B:2B:A7:AB:EC:4B:BE:48:DC:96:E9:4C:63:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hotline@hfk-bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FC21A0A04BABBDF32A545B730672E715C801C048596060435B5579B433CF62B7
    SPKI SHA256: 84754B93B82B9EBF2DE3F02FCB67F72484AFF22B0C864FD0430DB4A630A0A07B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HFK-BREMEN-CA

- Subject: countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Hochschule fuer Kuenste Bremen, commonName=HFK-BREMEN-CA, emailAddress=hotline@hfk-bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF75B4B4F0F
- SHA-256: 910E7D2253CB5AEA37C25F684FFB9AA699DB904257E16B6741FEC4F21DF353CB
- SPKI SHA-256: 84754B93B82B9EBF2DE3F02FCB67F72484AFF22B0C864FD0430DB4A630A0A07B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401387790095 (0x17aff75b4b4f0f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bremen, L = Bremen, O = Hochschule fuer Kuenste Bremen, CN = HFK-BREMEN-CA, emailAddress = hotline@hfk-bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:25:8B:7D:C6:EB:1B:2B:A7:AB:EC:4B:BE:48:DC:96:E9:4C:63:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hotline@hfk-bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 910E7D2253CB5AEA37C25F684FFB9AA699DB904257E16B6741FEC4F21DF353CB
    SPKI SHA256: 84754B93B82B9EBF2DE3F02FCB67F72484AFF22B0C864FD0430DB4A630A0A07B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HfMT Hamburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Hochschule fuer Musik und Theater Hamburg, organizationalUnitName=IT Service Center, commonName=HfMT Hamburg CA - G01, emailAddress=pki@itsc.hfmt-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DB933A82
- SHA-256: DB86160EF8DEC1365036EC29FA5B8C625C44EF337256BC4EB9191C0525C027F6
- SPKI SHA-256: B69CCCADB744AE3C3E14F7DE3C18F0CF4CEF5B1184E4A24C54A49DBFBF22AEB1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399245019778 (0x17aff6db933a82)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Hochschule fuer Musik und Theater Hamburg, OU = IT Service Center, CN = HfMT Hamburg CA - G01, emailAddress = pki@itsc.hfmt-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BF:8E:9C:DA:FA:DB:71:81:E1:91:43:B2:45:2D:1F:8D:B3:10:4F:02
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@itsc.hfmt-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DB86160EF8DEC1365036EC29FA5B8C625C44EF337256BC4EB9191C0525C027F6
    SPKI SHA256: B69CCCADB744AE3C3E14F7DE3C18F0CF4CEF5B1184E4A24C54A49DBFBF22AEB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HfMT Hamburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Hochschule fuer Musik und Theater Hamburg, organizationalUnitName=IT Service Center, commonName=HfMT Hamburg CA - G01, emailAddress=pki@itsc.hfmt-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 101B4DFD
- SHA-256: 0FBC44BB2ACBE1395C5FF18BCAB6AD233C61678A679A80A994F223424BDCF078
- SPKI SHA-256: B69CCCADB744AE3C3E14F7DE3C18F0CF4CEF5B1184E4A24C54A49DBFBF22AEB1
- Validity: 2010-05-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 270224893 (0x101b4dfd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 25 13:28:13 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Hochschule fuer Musik und Theater Hamburg, OU = IT Service Center, CN = HfMT Hamburg CA - G01, emailAddress = pki@itsc.hfmt-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BF:8E:9C:DA:FA:DB:71:81:E1:91:43:B2:45:2D:1F:8D:B3:10:4F:02
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@itsc.hfmt-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0FBC44BB2ACBE1395C5FF18BCAB6AD233C61678A679A80A994F223424BDCF078
    SPKI SHA256: B69CCCADB744AE3C3E14F7DE3C18F0CF4CEF5B1184E4A24C54A49DBFBF22AEB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HfT-Stuttgart CA-G01

- Subject: countryName=DE, organizationName=Hochschule fuer Technik Stuttgart, organizationalUnitName=Rechenzentrum, commonName=HfT-Stuttgart CA-G01, emailAddress=pki@hft-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ABAD82D
- SHA-256: E5F44748285F993489CD6590DD2428DA24896EB88D7AFE159D5FB6744ABFE360
- SPKI SHA-256: 9E21B84C096FB7523CC5BA1D72DE42AF72CFE51F1A2ABB00C4BE0A9E2D4A2009
- Validity: 2007-07-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180017197 (0xabad82d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 16 11:46:39 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik Stuttgart, OU = Rechenzentrum, CN = HfT-Stuttgart CA-G01, emailAddress = pki@hft-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                71:B5:99:9E:D6:1F:80:71:4E:C8:4F:5E:18:FB:BA:81:FE:95:FB:13
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hft-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E5F44748285F993489CD6590DD2428DA24896EB88D7AFE159D5FB6744ABFE360
    SPKI SHA256: 9E21B84C096FB7523CC5BA1D72DE42AF72CFE51F1A2ABB00C4BE0A9E2D4A2009
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HfT-Stuttgart CA-G01

- Subject: countryName=DE, organizationName=Hochschule fuer Technik Stuttgart, organizationalUnitName=Rechenzentrum, commonName=HfT-Stuttgart CA-G01, emailAddress=pki@hft-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42486DEEC72
- SHA-256: 4E170226B6A6F35AE2BB6139F69F0C67571AF7557618E8ABD476354913C143C2
- SPKI SHA-256: 9E21B84C096FB7523CC5BA1D72DE42AF72CFE51F1A2ABB00C4BE0A9E2D4A2009
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401252879474 (0x17a42486deec72)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:42 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik Stuttgart, OU = Rechenzentrum, CN = HfT-Stuttgart CA-G01, emailAddress = pki@hft-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                71:B5:99:9E:D6:1F:80:71:4E:C8:4F:5E:18:FB:BA:81:FE:95:FB:13
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hft-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E170226B6A6F35AE2BB6139F69F0C67571AF7557618E8ABD476354913C143C2
    SPKI SHA256: 9E21B84C096FB7523CC5BA1D72DE42AF72CFE51F1A2ABB00C4BE0A9E2D4A2009
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HFU CA - G01

- Subject: countryName=DE, organizationName=Hochschule Furtwangen, organizationalUnitName=Rechenzentrum, commonName=HFU CA - G01, emailAddress=pki-ca@hs-furtwangen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D65AE5F
- SHA-256: FE305AB0CA006312F82AF8BD96F02BCE2668CD97658743FD5D0C2D006C9AD059
- SPKI SHA-256: FFABD8E681A9847C10BAD03B015F0BCC105E846670380BB791D1C07B8077B128
- Validity: 2008-12-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 224767583 (0xd65ae5f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 15 10:26:24 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Furtwangen, OU = Rechenzentrum, CN = HFU CA - G01, emailAddress = pki-ca@hs-furtwangen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                68:70:10:0D:C9:2D:73:06:F9:88:18:3E:9F:8B:8C:ED:29:00:16:C7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@hs-furtwangen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FE305AB0CA006312F82AF8BD96F02BCE2668CD97658743FD5D0C2D006C9AD059
    SPKI SHA256: FFABD8E681A9847C10BAD03B015F0BCC105E846670380BB791D1C07B8077B128
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HFU CA - G01

- Subject: countryName=DE, organizationName=Hochschule Furtwangen, organizationalUnitName=Rechenzentrum, commonName=HFU CA - G01, emailAddress=pki-ca@hs-furtwangen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A20BB287
- SHA-256: 1F81773E6E553BC37D852D01620267B434094475881B09868E6AAA8F430C9661
- SPKI SHA-256: FFABD8E681A9847C10BAD03B015F0BCC105E846670380BB791D1C07B8077B128
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398279836295 (0x17aff6a20bb287)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Furtwangen, OU = Rechenzentrum, CN = HFU CA - G01, emailAddress = pki-ca@hs-furtwangen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                68:70:10:0D:C9:2D:73:06:F9:88:18:3E:9F:8B:8C:ED:29:00:16:C7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-ca@hs-furtwangen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1F81773E6E553BC37D852D01620267B434094475881B09868E6AAA8F430C9661
    SPKI SHA256: FFABD8E681A9847C10BAD03B015F0BCC105E846670380BB791D1C07B8077B128
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HfWU

- Subject: countryName=DE, organizationName=Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, commonName=HfWU, emailAddress=ca@hfwu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A425389CB255
- SHA-256: 0452FE80B160D5206E3CF21CE9FEB5579323B036B319609A5BFB2416661076DA
- SPKI SHA-256: 49F6B56789DF77028F6B6248C5C2A91A25095AACD0699B527860C11353BEDD40
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404234883669 (0x17a425389cb255)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, CN = HfWU, emailAddress = ca@hfwu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3A:95:69:6D:19:D7:5A:8E:69:83:AD:66:57:D9:6A:A7:8A:73:BC:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hfwu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0452FE80B160D5206E3CF21CE9FEB5579323B036B319609A5BFB2416661076DA
    SPKI SHA256: 49F6B56789DF77028F6B6248C5C2A91A25095AACD0699B527860C11353BEDD40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HfWU

- Subject: countryName=DE, organizationName=Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, commonName=HfWU, emailAddress=ca@hfwu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AAD9F2C
- SHA-256: 2ABEF1F2994C4A25C97E566C4DC0C636FC528082E38ED8FFA903D319FA6A75AF
- SPKI SHA-256: 49F6B56789DF77028F6B6248C5C2A91A25095AACD0699B527860C11353BEDD40
- Validity: 2007-07-06 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179150636 (0xaad9f2c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  6 11:03:58 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen, CN = HfWU, emailAddress = ca@hfwu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3A:95:69:6D:19:D7:5A:8E:69:83:AD:66:57:D9:6A:A7:8A:73:BC:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hfwu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2ABEF1F2994C4A25C97E566C4DC0C636FC528082E38ED8FFA903D319FA6A75AF
    SPKI SHA256: 49F6B56789DF77028F6B6248C5C2A91A25095AACD0699B527860C11353BEDD40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HGB Leipzig CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Grafik und Buchkunst Leipzig, organizationalUnitName=Rechenzentrum, commonName=HGB Leipzig CA - G02, emailAddress=pki@hgb-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC8A
- SHA-256: 9B77F81AAB688CF39EF3F26D4396384C66FA0220DD117DA59ABD0CE531D29F6C
- SPKI SHA-256: B727CD3274E3562ACD30C058B51E86EAB7E56EA077C7E558ACCB7F9DB3DB5A31
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027594 (0xa31ac8a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:56 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Grafik und Buchkunst Leipzig, OU = Rechenzentrum, CN = HGB Leipzig CA - G02, emailAddress = pki@hgb-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C9:C6:D7:70:C9:52:B0:6D:43:33:22:96:F5:B6:33:0B:DA:F8:8A:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hgb-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9B77F81AAB688CF39EF3F26D4396384C66FA0220DD117DA59ABD0CE531D29F6C
    SPKI SHA256: B727CD3274E3562ACD30C058B51E86EAB7E56EA077C7E558ACCB7F9DB3DB5A31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HGB Leipzig CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Grafik und Buchkunst Leipzig, organizationalUnitName=Rechenzentrum, commonName=HGB Leipzig CA - G02, emailAddress=pki@hgb-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610F73FAD0
- SHA-256: 223C70D707B29F94712EB33B1970DE954283954E83C0EE276FECA800ED3FF116
- SPKI SHA-256: B727CD3274E3562ACD30C058B51E86EAB7E56EA077C7E558ACCB7F9DB3DB5A31
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671009831632 (0x1790610f73fad0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Grafik und Buchkunst Leipzig, OU = Rechenzentrum, CN = HGB Leipzig CA - G02, emailAddress = pki@hgb-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C9:C6:D7:70:C9:52:B0:6D:43:33:22:96:F5:B6:33:0B:DA:F8:8A:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hgb-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 223C70D707B29F94712EB33B1970DE954283954E83C0EE276FECA800ED3FF116
    SPKI SHA256: B727CD3274E3562ACD30C058B51E86EAB7E56EA077C7E558ACCB7F9DB3DB5A31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HIS GmbH CA

- Subject: countryName=DE, organizationName=Hochschul-Informations-System GmbH, commonName=HIS GmbH CA, emailAddress=ca@his.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F87AF2F
- SHA-256: 86EA3CA90A60F5DEF3F0544F53054271A0AB9A058C243543FBBD718F8A0E2CE6
- SPKI SHA-256: 9F76E468470D5EEB12F4C6E93C0C3C2B3BF91DD958FCAFDDACF4AC9C388BD521
- Validity: 2010-02-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 260550447 (0xf87af2f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  2 14:07:28 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschul-Informations-System GmbH, CN = HIS GmbH CA, emailAddress = ca@his.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                34:35:44:8A:5B:8E:29:65:81:20:BD:AC:55:1C:F0:AA:38:66:A5:CC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@his.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 86EA3CA90A60F5DEF3F0544F53054271A0AB9A058C243543FBBD718F8A0E2CE6
    SPKI SHA256: 9F76E468470D5EEB12F4C6E93C0C3C2B3BF91DD958FCAFDDACF4AC9C388BD521
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HIS GmbH CA

- Subject: countryName=DE, organizationName=Hochschul-Informations-System GmbH, commonName=HIS GmbH CA, emailAddress=ca@his.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6CD63FC5F
- SHA-256: 3379277FB2DD70E2BC681BBD40B2C66D92EF974A798D2B6AF79A20E431F4891A
- SPKI SHA-256: 9F76E468470D5EEB12F4C6E93C0C3C2B3BF91DD958FCAFDDACF4AC9C388BD521
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399007042655 (0x17aff6cd63fc5f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:49 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschul-Informations-System GmbH, CN = HIS GmbH CA, emailAddress = ca@his.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                34:35:44:8A:5B:8E:29:65:81:20:BD:AC:55:1C:F0:AA:38:66:A5:CC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@his.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3379277FB2DD70E2BC681BBD40B2C66D92EF974A798D2B6AF79A20E431F4891A
    SPKI SHA256: 9F76E468470D5EEB12F4C6E93C0C3C2B3BF91DD958FCAFDDACF4AC9C388BD521
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HKI Jena CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Hans-Knoell-Institut (HKI), commonName=HKI Jena CA - G01, emailAddress=ca@hki-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15DFAFD8B9547E
- SHA-256: 1FE9F3942F249623D5DA593816556E16064C23989605B0D26B185C0FD20BC8F3
- SPKI SHA-256: 763082913944A78479256D64C444CF5A74CD74A6EABBF3DD666B2E92EB9CEDA1
- Validity: 2013-06-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6156920859219070 (0x15dfafd8b9547e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 18 10:11:20 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Hans-Knoell-Institut (HKI), CN = HKI Jena CA - G01, emailAddress = ca@hki-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1B:F0:12:9D:40:F1:AC:D9:9E:58:2B:D9:88:FF:DB:9C:8C:58:EA:C9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hki-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1FE9F3942F249623D5DA593816556E16064C23989605B0D26B185C0FD20BC8F3
    SPKI SHA256: 763082913944A78479256D64C444CF5A74CD74A6EABBF3DD666B2E92EB9CEDA1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HKI Jena CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Hans-Knoell-Institut (HKI), commonName=HKI Jena CA - G01, emailAddress=ca@hki-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF716A3ACBC
- SHA-256: CAEE820C636713D7F143CF673BBDEBA16AED37C4346A8693050BEC8C36932E42
- SPKI SHA-256: 763082913944A78479256D64C444CF5A74CD74A6EABBF3DD666B2E92EB9CEDA1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400235953340 (0x17aff716a3acbc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Hans-Knoell-Institut (HKI), CN = HKI Jena CA - G01, emailAddress = ca@hki-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1B:F0:12:9D:40:F1:AC:D9:9E:58:2B:D9:88:FF:DB:9C:8C:58:EA:C9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hki-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CAEE820C636713D7F143CF673BBDEBA16AED37C4346A8693050BEC8C36932E42
    SPKI SHA256: 763082913944A78479256D64C444CF5A74CD74A6EABBF3DD666B2E92EB9CEDA1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HM Stuttgart CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=HM Stuttgart CA, emailAddress=ca@mh-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AA9DB15
- SHA-256: BAF2087E054415D876C92A842B2DEB79FFF781114E683F042CAAE693BE5ED67E
- SPKI SHA-256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
- Validity: 2007-07-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 178903829 (0xaa9db15)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  3 14:30:31 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Stuttgart, O = Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, CN = HM Stuttgart CA, emailAddress = ca@mh-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7F:1B:AC:47:6F:E3:9F:B1:5F:A3:0C:B3:C5:C2:EF:D0:52:AE:5B:B8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BAF2087E054415D876C92A842B2DEB79FFF781114E683F042CAAE693BE5ED67E
    SPKI SHA256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HMI CA - G02

- Subject: countryName=DE, organizationName=Hahn-Meitner-Institut Berlin GmbH, organizationalUnitName=Abteilung DV-Systeme und Netze, commonName=HMI CA - G02, emailAddress=hmica@hmi.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A285C4D
- SHA-256: 1613DADEE7EC034FD0FE07BF274D8A09671F34F08BFF326D0973BD7F3546D1A7
- SPKI SHA-256: 4AB10C7A13382CD8231AA8DAF7EF5F1D02790691C0AEB9F41A3EAA89C9BA309F
- Validity: 2007-03-27 to 2019-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170417229 (0xa285c4d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 09:07:10 2007 GMT
            Not After : Mar 26 00:00:00 2019 GMT
        Subject: C = DE, O = Hahn-Meitner-Institut Berlin GmbH, OU = Abteilung DV-Systeme und Netze, CN = HMI CA - G02, emailAddress = hmica@hmi.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F0:BE:7F:8A:55:23:B1:F7:F0:07:8D:EE:0D:A2:22:FB:7E:CA:81:B8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hmica@hmi.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1613DADEE7EC034FD0FE07BF274D8A09671F34F08BFF326D0973BD7F3546D1A7
    SPKI SHA256: 4AB10C7A13382CD8231AA8DAF7EF5F1D02790691C0AEB9F41A3EAA89C9BA309F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HMT Hannover CA

- Subject: countryName=DE, organizationName=Hochschule fuer Musik und Theater Hannover, commonName=HMT Hannover CA, emailAddress=pki@hmt-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D86A4D4
- SHA-256: 9BEE2EC900A13A1479080CF79506F021CAA99C59DD04D5CB250D908C1A7C64F6
- SPKI SHA-256: 75185765738F15E1ED1AB4694D27CC228480839B3093E93F2BB5AB32D64C6FA4
- Validity: 2009-01-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 226927828 (0xd86a4d4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  9 10:30:29 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Musik und Theater Hannover, CN = HMT Hannover CA, emailAddress = pki@hmt-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                06:15:9F:E9:5D:6B:CC:BE:E9:68:46:30:A5:39:C9:98:BA:CF:5D:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hmt-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9BEE2EC900A13A1479080CF79506F021CAA99C59DD04D5CB250D908C1A7C64F6
    SPKI SHA256: 75185765738F15E1ED1AB4694D27CC228480839B3093E93F2BB5AB32D64C6FA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HMT Rostock CA - G01

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Hochschule fuer Musik und Theater Rostock, commonName=HMT Rostock CA - G01, emailAddress=ca@hmt-rostock.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 18D74AC02667B8
- SHA-256: F0E85F752A8B8A5AC15227B52212AAAFA389FB4194BF63F0304B52388649D30D
- SPKI SHA-256: CBD655508006767DD216DBE8BAA815D3D6F1B83C67CE02C1AD2260FC80320284
- Validity: 2015-01-15 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6992115492349880 (0x18d74ac02667b8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 15 14:22:41 2015 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Rostock, O = Hochschule fuer Musik und Theater Rostock, CN = HMT Rostock CA - G01, emailAddress = ca@hmt-rostock.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                94:94:AC:35:C3:49:2F:1E:B3:71:45:B2:26:1F:C5:18:6E:08:55:5C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hmt-rostock.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F0E85F752A8B8A5AC15227B52212AAAFA389FB4194BF63F0304B52388649D30D
    SPKI SHA256: CBD655508006767DD216DBE8BAA815D3D6F1B83C67CE02C1AD2260FC80320284
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HMT-LEIPZIG-CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Musik und Theater Leipzig, commonName=HMT-LEIPZIG-CA, emailAddress=pki@hmt-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4255CC4085C
- SHA-256: 3EB9D193324618A06BC8068F6158A391417CEAE23F475995256A38F677D1C4A8
- SPKI SHA-256: A698E9D6C3876BDA88DF11261500C9B129F3ABBD4FF8329A64B84D131E8328CE
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404841441372 (0x17a4255cc4085c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:16 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Hochschule fuer Musik und Theater Leipzig, CN = HMT-LEIPZIG-CA, emailAddress = pki@hmt-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                83:26:CF:05:1B:1F:98:67:87:73:B0:E0:EC:F7:69:F8:1C:8B:9A:15
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hmt-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3EB9D193324618A06BC8068F6158A391417CEAE23F475995256A38F677D1C4A8
    SPKI SHA256: A698E9D6C3876BDA88DF11261500C9B129F3ABBD4FF8329A64B84D131E8328CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HMT-LEIPZIG-CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Musik und Theater Leipzig, commonName=HMT-LEIPZIG-CA, emailAddress=pki@hmt-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A45494B
- SHA-256: 7B55E7A02223E2BC9BE0E4C137A6DAAC7FE2B015BB5244C56B4B54FFC3567CB3
- SPKI SHA-256: A698E9D6C3876BDA88DF11261500C9B129F3ABBD4FF8329A64B84D131E8328CE
- Validity: 2007-04-18 to 2019-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 172312907 (0xa45494b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 18 07:41:48 2007 GMT
            Not After : Apr 17 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = Hochschule fuer Musik und Theater Leipzig, CN = HMT-LEIPZIG-CA, emailAddress = pki@hmt-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                83:26:CF:05:1B:1F:98:67:87:73:B0:E0:EC:F7:69:F8:1C:8B:9A:15
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hmt-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7B55E7A02223E2BC9BE0E4C137A6DAAC7FE2B015BB5244C56B4B54FFC3567CB3
    SPKI SHA256: A698E9D6C3876BDA88DF11261500C9B129F3ABBD4FF8329A64B84D131E8328CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HMTM Hannover CA

- Subject: countryName=DE, organizationName=Hochschule fuer Musik, Theater und Medien Hannover, commonName=HMTM Hannover CA, emailAddress=pki@hmtm-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10511FF1
- SHA-256: 2CC0719212B9A91017770D5813E9590FAD77D9139B3D7FC110EF63FACDAD0C85
- SPKI SHA-256: 0E90A8A2C3B3BE48874118139082B51AD0393EADC9C41A22857764644760A204
- Validity: 2010-07-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 273752049 (0x10511ff1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  5 09:14:09 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = "Hochschule fuer Musik, Theater und Medien Hannover", CN = HMTM Hannover CA, emailAddress = pki@hmtm-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                55:AE:67:66:59:08:EF:6E:6D:F4:4C:AC:4A:FE:FF:8F:1C:67:82:74
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hmtm-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2CC0719212B9A91017770D5813E9590FAD77D9139B3D7FC110EF63FACDAD0C85
    SPKI SHA256: 0E90A8A2C3B3BE48874118139082B51AD0393EADC9C41A22857764644760A204
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HMTM Hannover CA

- Subject: countryName=DE, organizationName=Hochschule fuer Musik, Theater und Medien Hannover, commonName=HMTM Hannover CA, emailAddress=pki@hmtm-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E27415B4
- SHA-256: 3912949CE0561E9678A425A459B5EF3F0620137AF17690E1B1A838784DE08588
- SPKI SHA-256: 0E90A8A2C3B3BE48874118139082B51AD0393EADC9C41A22857764644760A204
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399360419252 (0x17aff6e27415b4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:10 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = "Hochschule fuer Musik, Theater und Medien Hannover", CN = HMTM Hannover CA, emailAddress = pki@hmtm-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                55:AE:67:66:59:08:EF:6E:6D:F4:4C:AC:4A:FE:FF:8F:1C:67:82:74
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hmtm-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3912949CE0561E9678A425A459B5EF3F0620137AF17690E1B1A838784DE08588
    SPKI SHA256: 0E90A8A2C3B3BE48874118139082B51AD0393EADC9C41A22857764644760A204
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Bonn-Rhein-Sieg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Hochschule Bonn-Rhein-Sieg, commonName=Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@hochschule-bonn-rhein-sieg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F0645B5
- SHA-256: AFC5207F152369FA24324C5736BD99B5EC88B2050954BCCEE203E1389C521B04
- SPKI SHA-256: AF46EA62BBA2EC936E1B6C9BC85FF8C6F480D6CE4797EE8080F9FA111EE57C31
- Validity: 2009-10-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 252069301 (0xf0645b5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 27 10:15:02 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, O = Hochschule Bonn-Rhein-Sieg, CN = Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress = pki@hochschule-bonn-rhein-sieg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2E:EA:54:C4:4F:B9:47:B0:20:50:5A:D4:C7:26:A1:30:FD:55:0B:32
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hochschule-bonn-rhein-sieg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AFC5207F152369FA24324C5736BD99B5EC88B2050954BCCEE203E1389C521B04
    SPKI SHA256: AF46EA62BBA2EC936E1B6C9BC85FF8C6F480D6CE4797EE8080F9FA111EE57C31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Bonn-Rhein-Sieg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, organizationName=Hochschule Bonn-Rhein-Sieg, commonName=Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress=pki@hochschule-bonn-rhein-sieg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C0BDBACF
- SHA-256: 7BCF1547C080EC95D02A6E2D3FB08F8BF3315D58260DC6F1C80CC007F190A56D
- SPKI SHA-256: AF46EA62BBA2EC936E1B6C9BC85FF8C6F480D6CE4797EE8080F9FA111EE57C31
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398794820303 (0x17aff6c0bdbacf)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, O = Hochschule Bonn-Rhein-Sieg, CN = Hochschule Bonn-Rhein-Sieg CA - G01, emailAddress = pki@hochschule-bonn-rhein-sieg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:EA:54:C4:4F:B9:47:B0:20:50:5A:D4:C7:26:A1:30:FD:55:0B:32
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hochschule-bonn-rhein-sieg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7BCF1547C080EC95D02A6E2D3FB08F8BF3315D58260DC6F1C80CC007F190A56D
    SPKI SHA256: AF46EA62BBA2EC936E1B6C9BC85FF8C6F480D6CE4797EE8080F9FA111EE57C31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Bremen CA 1

- Subject: countryName=DE, organizationName=Hochschule Bremen, commonName=Hochschule Bremen CA 1, emailAddress=pki@hs-bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DE9AA51
- SHA-256: E404E73D239A355A982CEB24AED6C9D1BD8156F0D5102C12CA33ACF45D9F89D2
- SPKI SHA-256: 460CDE8244613DF99A6583FB9B5914AF500EF987BA66B2AB3E1DB5445A74FDCB
- Validity: 2009-03-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 233417297 (0xde9aa51)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 25 13:08:17 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Bremen, CN = Hochschule Bremen CA 1, emailAddress = pki@hs-bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                28:76:15:FD:BA:35:13:C6:47:BE:17:71:1F:FE:74:C3:C1:ED:D4:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E404E73D239A355A982CEB24AED6C9D1BD8156F0D5102C12CA33ACF45D9F89D2
    SPKI SHA256: 460CDE8244613DF99A6583FB9B5914AF500EF987BA66B2AB3E1DB5445A74FDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Bremen CA 1

- Subject: countryName=DE, organizationName=Hochschule Bremen, commonName=Hochschule Bremen CA 1, emailAddress=pki@hs-bremen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A98E2669
- SHA-256: 549D054FDBA722D2AD45D947BB4A5F7A036F1A917E5F62431E42862B2B3F35BB
- SPKI SHA-256: 460CDE8244613DF99A6583FB9B5914AF500EF987BA66B2AB3E1DB5445A74FDCB
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398405826153 (0x17aff6a98e2669)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:14 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Bremen, CN = Hochschule Bremen CA 1, emailAddress = pki@hs-bremen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                28:76:15:FD:BA:35:13:C6:47:BE:17:71:1F:FE:74:C3:C1:ED:D4:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-bremen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 549D054FDBA722D2AD45D947BB4A5F7A036F1A917E5F62431E42862B2B3F35BB
    SPKI SHA256: 460CDE8244613DF99A6583FB9B5914AF500EF987BA66B2AB3E1DB5445A74FDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Bremerhaven CA

- Subject: countryName=DE, organizationName=Hochschule Bremerhaven, organizationalUnitName=ZBRV, commonName=Hochschule Bremerhaven CA, emailAddress=pki@hs-bremerhaven.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E14F99A
- SHA-256: 3F5ADAF6A6B947290AEE04988D93C08A346806E2EA008D26E0F529E4D6E62D60
- SPKI SHA-256: 10ABF5EB66B2FD35AEFB04B72D95BFA9C53789345DC1FE72198322E8A357D269
- Validity: 2009-04-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 236255642 (0xe14f99a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 27 09:34:02 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Bremerhaven, OU = ZBRV, CN = Hochschule Bremerhaven CA, emailAddress = pki@hs-bremerhaven.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7F:64:87:A8:4F:65:FA:F7:4B:5C:BD:B6:4D:D6:A0:0A:9A:6D:93:A1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-bremerhaven.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3F5ADAF6A6B947290AEE04988D93C08A346806E2EA008D26E0F529E4D6E62D60
    SPKI SHA256: 10ABF5EB66B2FD35AEFB04B72D95BFA9C53789345DC1FE72198322E8A357D269
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Bremerhaven CA

- Subject: countryName=DE, organizationName=Hochschule Bremerhaven, organizationalUnitName=ZBRV, commonName=Hochschule Bremerhaven CA, emailAddress=pki@hs-bremerhaven.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6AE5E52FD
- SHA-256: F25478BB0DA99E7629AA927B7EA0983862ED95B171A491AE5000AE3EE1942229
- SPKI SHA-256: 10ABF5EB66B2FD35AEFB04B72D95BFA9C53789345DC1FE72198322E8A357D269
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398486577917 (0x17aff6ae5e52fd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Bremerhaven, OU = ZBRV, CN = Hochschule Bremerhaven CA, emailAddress = pki@hs-bremerhaven.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7F:64:87:A8:4F:65:FA:F7:4B:5C:BD:B6:4D:D6:A0:0A:9A:6D:93:A1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-bremerhaven.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F25478BB0DA99E7629AA927B7EA0983862ED95B171A491AE5000AE3EE1942229
    SPKI SHA256: 10ABF5EB66B2FD35AEFB04B72D95BFA9C53789345DC1FE72198322E8A357D269
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Darmstadt

- Subject: countryName=DE, localityName=Darmstadt, organizationName=Hochschule Darmstadt, commonName=Hochschule Darmstadt, emailAddress=pki@h-da.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A7CE292
- SHA-256: 4AC61F2E677E5816F2DEF72559D180B78E2DA2007909F51B3758993DD59DA4FE
- SPKI SHA-256: 0147FB894A28715C8EE2049F5F7808BAD7CAFD7800CD51E90F1783B3CE251783
- Validity: 2007-05-30 to 2019-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175956626 (0xa7ce292)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 30 11:50:28 2007 GMT
            Not After : May 28 00:00:00 2019 GMT
        Subject: C = DE, L = Darmstadt, O = Hochschule Darmstadt, CN = Hochschule Darmstadt, emailAddress = pki@h-da.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0A:0E:84:38:6F:04:E6:4F:F7:C1:E8:8E:14:DD:31:7A:5A:BC:D1:B4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@h-da.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4AC61F2E677E5816F2DEF72559D180B78E2DA2007909F51B3758993DD59DA4FE
    SPKI SHA256: 0147FB894A28715C8EE2049F5F7808BAD7CAFD7800CD51E90F1783B3CE251783
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Darmstadt

- Subject: countryName=DE, localityName=Darmstadt, organizationName=Hochschule Darmstadt, commonName=Hochschule Darmstadt, emailAddress=pki@h-da.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42474D2E171
- SHA-256: 0F76DB7E0B5D606054A2273F14CE39B946C16DA2E8ADA25066A5CAA0FDCC5540
- SPKI SHA-256: 0147FB894A28715C8EE2049F5F7808BAD7CAFD7800CD51E90F1783B3CE251783
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400950100337 (0x17a42474d2e171)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:24 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Darmstadt, O = Hochschule Darmstadt, CN = Hochschule Darmstadt, emailAddress = pki@h-da.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0A:0E:84:38:6F:04:E6:4F:F7:C1:E8:8E:14:DD:31:7A:5A:BC:D1:B4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@h-da.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F76DB7E0B5D606054A2273F14CE39B946C16DA2E8ADA25066A5CAA0FDCC5540
    SPKI SHA256: 0147FB894A28715C8EE2049F5F7808BAD7CAFD7800CD51E90F1783B3CE251783
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Deggendorf CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Deggendorf, organizationName=Hochschule fuer angewandte Wissenschaften - FH Deggendorf, organizationalUnitName=Rechenzentrum, commonName=Hochschule Deggendorf CA - G01, emailAddress=pki@fh-deggendorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B1725A1A
- SHA-256: 44C5E3D664349D4958B04C9E5A2033C6D67012916D709C2D4D66FEF3E78C3982
- SPKI SHA-256: 646E7770BB7F79D2CACC099A1EBDBA7BF6A9861892D0A7721B5FEF25B9955CC7
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401967184410 (0x17a424b1725a1a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Deggendorf, O = Hochschule fuer angewandte Wissenschaften - FH Deggendorf, OU = Rechenzentrum, CN = Hochschule Deggendorf CA - G01, emailAddress = pki@fh-deggendorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:C2:35:BA:01:5D:8B:78:4F:BF:27:D4:07:13:9E:99:F7:46:00:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-deggendorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 44C5E3D664349D4958B04C9E5A2033C6D67012916D709C2D4D66FEF3E78C3982
    SPKI SHA256: 646E7770BB7F79D2CACC099A1EBDBA7BF6A9861892D0A7721B5FEF25B9955CC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Deggendorf CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Deggendorf, organizationName=Hochschule fuer angewandte Wissenschaften - FH Deggendorf, organizationalUnitName=Rechenzentrum, commonName=Hochschule Deggendorf CA - G01, emailAddress=pki@fh-deggendorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C0988E9
- SHA-256: E83393EBEE055A62BE14B41B389A32CF73E275DC65B9A06F163419E733B3A25D
- SPKI SHA-256: 646E7770BB7F79D2CACC099A1EBDBA7BF6A9861892D0A7721B5FEF25B9955CC7
- Validity: 2008-03-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 201951465 (0xc0988e9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 26 08:37:47 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Deggendorf, O = Hochschule fuer angewandte Wissenschaften - FH Deggendorf, OU = Rechenzentrum, CN = Hochschule Deggendorf CA - G01, emailAddress = pki@fh-deggendorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:C2:35:BA:01:5D:8B:78:4F:BF:27:D4:07:13:9E:99:F7:46:00:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-deggendorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E83393EBEE055A62BE14B41B389A32CF73E275DC65B9A06F163419E733B3A25D
    SPKI SHA256: 646E7770BB7F79D2CACC099A1EBDBA7BF6A9861892D0A7721B5FEF25B9955CC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer angewandte Wissenschaften FH Hof CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Hof, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, organizationalUnitName=Rechenzentrum, commonName=Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress=pki@fh-hof.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B184A94
- SHA-256: D11908219C52BCA4172ED4DF09ED98CC4E68EF61979BA550C3992204AD21B7E9
- SPKI SHA-256: BC7628C7FFF5540DBB77948E24503869BAF4DD19157D78A302510636FA9513C9
- Validity: 2007-09-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 186141332 (0xb184a94)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 25 08:55:34 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Hof, O = Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, OU = Rechenzentrum, CN = Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress = pki@fh-hof.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4A:3D:7B:4D:F1:41:3C:F2:E8:62:2C:89:CA:53:72:E2:AE:16:7F:55
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-hof.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D11908219C52BCA4172ED4DF09ED98CC4E68EF61979BA550C3992204AD21B7E9
    SPKI SHA256: BC7628C7FFF5540DBB77948E24503869BAF4DD19157D78A302510636FA9513C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer angewandte Wissenschaften FH Hof CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Hof, organizationName=Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, organizationalUnitName=Rechenzentrum, commonName=Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress=pki@fh-hof.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424906721BD
- SHA-256: 6CA1CDC6284817BA168CB0B3976A36C3C43EC5BE3DECE3ACA21BC4ACB18403C0
- SPKI SHA-256: BC7628C7FFF5540DBB77948E24503869BAF4DD19157D78A302510636FA9513C9
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401412800957 (0x17a424906721bd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Hof, O = Hochschule fuer angewandte Wissenschaften Fachhochschule Hof, OU = Rechenzentrum, CN = Hochschule fuer angewandte Wissenschaften FH Hof CA - G01, emailAddress = pki@fh-hof.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4A:3D:7B:4D:F1:41:3C:F2:E8:62:2C:89:CA:53:72:E2:AE:16:7F:55
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-hof.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6CA1CDC6284817BA168CB0B3976A36C3C43EC5BE3DECE3ACA21BC4ACB18403C0
    SPKI SHA256: BC7628C7FFF5540DBB77948E24503869BAF4DD19157D78A302510636FA9513C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Film und Fernsehen 'Konrad Wolf' CA

- Subject: countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen 'Konrad Wolf', commonName=Hochschule fuer Film und Fernsehen 'Konrad Wolf' CA, emailAddress=pki@hff-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0EE57D69
- SHA-256: 65FE69C070C786D99C2A39774A6E08521DBFFD12F3F31A3D09F800C030C31822
- SPKI SHA-256: 8A82F9A333C937E9356D4AC974DE188EAD3149A4767D73B506E215E6BA201400
- Validity: 2009-10-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 249920873 (0xee57d69)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  2 13:27:53 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Potsdam-Babelsberg, O = Hochschule fuer Film und Fernsehen 'Konrad Wolf', CN = Hochschule fuer Film und Fernsehen 'Konrad Wolf' CA, emailAddress = pki@hff-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6D:31:12:01:82:00:9C:88:F9:33:4E:B4:DF:C8:B9:CA:C6:EC:C6:F3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hff-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 65FE69C070C786D99C2A39774A6E08521DBFFD12F3F31A3D09F800C030C31822
    SPKI SHA256: 8A82F9A333C937E9356D4AC974DE188EAD3149A4767D73B506E215E6BA201400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Film und Fernsehen Konrad Wolf CA

- Subject: countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen Konrad Wolf, commonName=Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress=pki@hff-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F110D6D
- SHA-256: 70E3B4AA11DE28BE53B7CE1AECF99925284384B63F553CA1EEE9420C4F1DD735
- SPKI SHA-256: 8871E014F21E4CB6CFBA6A70604E36EE55DDA6BC2608E62A460159EDF65E6E0F
- Validity: 2009-11-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 252775789 (0xf110d6d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  4 14:29:50 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Potsdam-Babelsberg, O = Hochschule fuer Film und Fernsehen Konrad Wolf, CN = Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress = pki@hff-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3F:50:73:0A:49:56:32:80:34:43:8F:AB:A9:F7:41:27:5C:08:66:F3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hff-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 70E3B4AA11DE28BE53B7CE1AECF99925284384B63F553CA1EEE9420C4F1DD735
    SPKI SHA256: 8871E014F21E4CB6CFBA6A70604E36EE55DDA6BC2608E62A460159EDF65E6E0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Film und Fernsehen Konrad Wolf CA

- Subject: countryName=DE, localityName=Potsdam-Babelsberg, organizationName=Hochschule fuer Film und Fernsehen Konrad Wolf, commonName=Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress=pki@hff-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C1473DA0
- SHA-256: E8A1E2035DD549E518D9DE02D7509DCECCEC6935010548563F4267D72A8E3DA3
- SPKI SHA-256: 8871E014F21E4CB6CFBA6A70604E36EE55DDA6BC2608E62A460159EDF65E6E0F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398803832224 (0x17aff6c1473da0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Potsdam-Babelsberg, O = Hochschule fuer Film und Fernsehen Konrad Wolf, CN = Hochschule fuer Film und Fernsehen Konrad Wolf CA, emailAddress = pki@hff-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3F:50:73:0A:49:56:32:80:34:43:8F:AB:A9:F7:41:27:5C:08:66:F3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hff-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E8A1E2035DD549E518D9DE02D7509DCECCEC6935010548563F4267D72A8E3DA3
    SPKI SHA256: 8871E014F21E4CB6CFBA6A70604E36EE55DDA6BC2608E62A460159EDF65E6E0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Gestaltung Karlsruhe CA - G01

- Subject: countryName=DE, organizationName=Hochschule fuer Gestaltung Karlsruhe, commonName=Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress=pki@hfg.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6BC96FD66
- SHA-256: DE9EB8276AB879E5E487E929879158CC89323C2F5BD022BE699C263BE99D36A9
- SPKI SHA-256: CC6825EC5F635023A57F195D9A078B11DAE2DA871B2971543994FBF11CC8CB9F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398725172582 (0x17aff6bc96fd66)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:32 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Gestaltung Karlsruhe, CN = Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress = pki@hfg.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                19:80:8C:3E:5C:F6:DC:8F:E5:B9:1A:C5:4C:EA:5F:C0:16:DE:16:00
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hfg.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE9EB8276AB879E5E487E929879158CC89323C2F5BD022BE699C263BE99D36A9
    SPKI SHA256: CC6825EC5F635023A57F195D9A078B11DAE2DA871B2971543994FBF11CC8CB9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Gestaltung Karlsruhe CA - G01

- Subject: countryName=DE, organizationName=Hochschule fuer Gestaltung Karlsruhe, commonName=Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress=pki@hfg.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ED2B719
- SHA-256: 1BE398E4030420B8BA4B178F0FF43910C91BABE46F882E6920FA78140C76D363
- SPKI SHA-256: CC6825EC5F635023A57F195D9A078B11DAE2DA871B2971543994FBF11CC8CB9F
- Validity: 2009-09-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 248690457 (0xed2b719)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 18 07:40:57 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Gestaltung Karlsruhe, CN = Hochschule fuer Gestaltung Karlsruhe CA - G01, emailAddress = pki@hfg.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                19:80:8C:3E:5C:F6:DC:8F:E5:B9:1A:C5:4C:EA:5F:C0:16:DE:16:00
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hfg.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1BE398E4030420B8BA4B178F0FF43910C91BABE46F882E6920FA78140C76D363
    SPKI SHA256: CC6825EC5F635023A57F195D9A078B11DAE2DA871B2971543994FBF11CC8CB9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Technik und Wirtschaft Berlin

- Subject: countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Hochschule fuer Technik und Wirtschaft Berlin, emailAddress=ca@htw-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DC215AB
- SHA-256: 9F3967E71CF558D1BA76008A39DCF84DFB9A119A1F74D1C7623F7B0C9E638339
- SPKI SHA-256: A50C019A0A5A46084C14B445DE8D977AFBF532FC12326EF99319B0E6B0593FED
- Validity: 2009-02-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 230823339 (0xdc215ab)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 23 12:35:40 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik und Wirtschaft Berlin, OU = HRZ, CN = Hochschule fuer Technik und Wirtschaft Berlin, emailAddress = ca@htw-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0D:DE:A4:31:0D:84:EF:10:B0:01:D1:6E:04:D8:56:9F:F8:8C:BE:95
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@htw-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9F3967E71CF558D1BA76008A39DCF84DFB9A119A1F74D1C7623F7B0C9E638339
    SPKI SHA256: A50C019A0A5A46084C14B445DE8D977AFBF532FC12326EF99319B0E6B0593FED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule fuer Technik und Wirtschaft Berlin

- Subject: countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Berlin, organizationalUnitName=HRZ, commonName=Hochschule fuer Technik und Wirtschaft Berlin, emailAddress=ca@htw-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A65E3516
- SHA-256: F9D2137F4C570DAA6EED788635E7B9AB328D83616A568AA42D879D437705A25C
- SPKI SHA-256: A50C019A0A5A46084C14B445DE8D977AFBF532FC12326EF99319B0E6B0593FED
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398352352534 (0x17aff6a65e3516)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:10 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik und Wirtschaft Berlin, OU = HRZ, CN = Hochschule fuer Technik und Wirtschaft Berlin, emailAddress = ca@htw-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0D:DE:A4:31:0D:84:EF:10:B0:01:D1:6E:04:D8:56:9F:F8:8C:BE:95
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@htw-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F9D2137F4C570DAA6EED788635E7B9AB328D83616A568AA42D879D437705A25C
    SPKI SHA256: A50C019A0A5A46084C14B445DE8D977AFBF532FC12326EF99319B0E6B0593FED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Hamm-Lippstadt CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hamm, organizationName=Hochschule Hamm-Lippstadt, commonName=Hochschule Hamm-Lippstadt CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 143B3E63DB3757
- SHA-256: 69BBFAA003941DC48408CD74263656717269CB89B86556D01EEAAE49D0D8769E
- SPKI SHA-256: 4B0E1A425C89CDB244CECDE70ACD66215F5AA039B8730CEF512DDE39C1C2A4A9
- Validity: 2012-08-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5694638683535191 (0x143b3e63db3757)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  3 12:15:16 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Hamm, O = Hochschule Hamm-Lippstadt, CN = Hochschule Hamm-Lippstadt CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7E:DC:7D:5E:45:69:6A:8C:EF:05:CA:75:06:B2:07:3C:55:2E:51:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 69BBFAA003941DC48408CD74263656717269CB89B86556D01EEAAE49D0D8769E
    SPKI SHA256: 4B0E1A425C89CDB244CECDE70ACD66215F5AA039B8730CEF512DDE39C1C2A4A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Hamm-Lippstadt CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Hamm, organizationName=Hochschule Hamm-Lippstadt, commonName=Hochschule Hamm-Lippstadt CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17887D0BD014C7
- SHA-256: 2E9CCBE89543956F8FAC30DB8AF115E1418A8ED46C22C710371EA0EAD8D8EACA
- SPKI SHA-256: 4B0E1A425C89CDB244CECDE70ACD66215F5AA039B8730CEF512DDE39C1C2A4A9
- Validity: 2014-05-06 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6623995114820807 (0x17887d0bd014c7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  6 15:27:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Hamm, O = Hochschule Hamm-Lippstadt, CN = Hochschule Hamm-Lippstadt CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7E:DC:7D:5E:45:69:6A:8C:EF:05:CA:75:06:B2:07:3C:55:2E:51:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E9CCBE89543956F8FAC30DB8AF115E1418A8ED46C22C710371EA0EAD8D8EACA
    SPKI SHA256: 4B0E1A425C89CDB244CECDE70ACD66215F5AA039B8730CEF512DDE39C1C2A4A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Heilbronn CA-G02

- Subject: countryName=DE, organizationName=Hochschule Heilbronn, organizationalUnitName=Rechenzentrum, commonName=Hochschule Heilbronn CA-G02, emailAddress=pki@hs-heilbronn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF699BBB1B2
- SHA-256: 127A48F1D10F4A3BA58108611D54CA7B5E0EA464FDA2E286102EF563C18965B7
- SPKI SHA-256: 749A001F2D85F3102F511BEFE2AE839958993C13BC0829C7CBE826129735F481
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398140375474 (0x17aff699bbb1b2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Heilbronn, OU = Rechenzentrum, CN = Hochschule Heilbronn CA-G02, emailAddress = pki@hs-heilbronn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                67:14:AF:61:67:92:65:9D:3A:3C:48:B4:E8:52:9B:FB:EA:F6:A4:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-heilbronn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 127A48F1D10F4A3BA58108611D54CA7B5E0EA464FDA2E286102EF563C18965B7
    SPKI SHA256: 749A001F2D85F3102F511BEFE2AE839958993C13BC0829C7CBE826129735F481
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Heilbronn CA-G02

- Subject: countryName=DE, organizationName=Hochschule Heilbronn, organizationalUnitName=Rechenzentrum, commonName=Hochschule Heilbronn CA-G02, emailAddress=pki@hs-heilbronn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CF9BB0D
- SHA-256: 44E4A9E87BF1485F02A642EBA40172235846981593FE7DE6C776AD70F3E79479
- SPKI SHA-256: 749A001F2D85F3102F511BEFE2AE839958993C13BC0829C7CBE826129735F481
- Validity: 2008-09-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 217692941 (0xcf9bb0d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 24 13:15:41 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Heilbronn, OU = Rechenzentrum, CN = Hochschule Heilbronn CA-G02, emailAddress = pki@hs-heilbronn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                67:14:AF:61:67:92:65:9D:3A:3C:48:B4:E8:52:9B:FB:EA:F6:A4:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-heilbronn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 44E4A9E87BF1485F02A642EBA40172235846981593FE7DE6C776AD70F3E79479
    SPKI SHA256: 749A001F2D85F3102F511BEFE2AE839958993C13BC0829C7CBE826129735F481
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Lausitz CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Senftenberg, organizationName=Hochschule Lausitz, commonName=Hochschule Lausitz CA, emailAddress=pki@hs-lausitz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E3C9CBA
- SHA-256: E6473750C7F2042F36D0F46FAA333926D5CE7ED646C0338572F85DFEFE31085E
- SPKI SHA-256: E44F9020F6CE6D5363737208885BA6AD98E1F4609A78DF2A612C5AAED22E624D
- Validity: 2009-05-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 238853306 (0xe3c9cba)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 11:08:26 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Senftenberg, O = Hochschule Lausitz, CN = Hochschule Lausitz CA, emailAddress = pki@hs-lausitz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                57:C1:A4:96:BB:47:01:86:89:75:F8:28:7F:83:4D:73:A6:78:4C:81
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-lausitz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E6473750C7F2042F36D0F46FAA333926D5CE7ED646C0338572F85DFEFE31085E
    SPKI SHA256: E44F9020F6CE6D5363737208885BA6AD98E1F4609A78DF2A612C5AAED22E624D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Lausitz CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Senftenberg, organizationName=Hochschule Lausitz, commonName=Hochschule Lausitz CA, emailAddress=pki@hs-lausitz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B2C49624
- SHA-256: EFE240FFD0031C7CCC18089F13D05A253AF88EA07D1163246FBB2E1889307A7E
- SPKI SHA-256: E44F9020F6CE6D5363737208885BA6AD98E1F4609A78DF2A612C5AAED22E624D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398560388644 (0x17aff6b2c49624)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:22 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Senftenberg, O = Hochschule Lausitz, CN = Hochschule Lausitz CA, emailAddress = pki@hs-lausitz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                57:C1:A4:96:BB:47:01:86:89:75:F8:28:7F:83:4D:73:A6:78:4C:81
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-lausitz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EFE240FFD0031C7CCC18089F13D05A253AF88EA07D1163246FBB2E1889307A7E
    SPKI SHA256: E44F9020F6CE6D5363737208885BA6AD98E1F4609A78DF2A612C5AAED22E624D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Muenchen CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Hochschule Muenchen, commonName=Hochschule Muenchen CA, emailAddress=dfn-ca@hm.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249F3D4EAA
- SHA-256: B19C1E827AB918AEC41367DC4ED912C04DC029182518EA17AE9585CAE862162C
- SPKI SHA-256: 366613FE3A049A37226F7FB6EA0E06F81DC7B88191F71F57ECC6E528C3F7C0A2
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401661718186 (0x17a4249f3d4eaa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:07 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Hochschule Muenchen, CN = Hochschule Muenchen CA, emailAddress = dfn-ca@hm.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                ED:6B:65:4F:5A:71:5E:09:D9:C5:47:C3:EE:A0:1D:A8:09:53:CE:AE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dfn-ca@hm.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B19C1E827AB918AEC41367DC4ED912C04DC029182518EA17AE9585CAE862162C
    SPKI SHA256: 366613FE3A049A37226F7FB6EA0E06F81DC7B88191F71F57ECC6E528C3F7C0A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Muenchen CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Hochschule Muenchen, commonName=Hochschule Muenchen CA, emailAddress=dfn-ca@hm.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B89EFB6
- SHA-256: 3996986564AB85ACC75CDD04577A690834B9FA0662409FBA88AA3143940007E4
- SPKI SHA-256: 366613FE3A049A37226F7FB6EA0E06F81DC7B88191F71F57ECC6E528C3F7C0A2
- Validity: 2007-12-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193589174 (0xb89efb6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 20 13:46:16 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Hochschule Muenchen, CN = Hochschule Muenchen CA, emailAddress = dfn-ca@hm.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                ED:6B:65:4F:5A:71:5E:09:D9:C5:47:C3:EE:A0:1D:A8:09:53:CE:AE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:dfn-ca@hm.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3996986564AB85ACC75CDD04577A690834B9FA0662409FBA88AA3143940007E4
    SPKI SHA256: 366613FE3A049A37226F7FB6EA0E06F81DC7B88191F71F57ECC6E528C3F7C0A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Niederrhein CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Krefeld, organizationName=Hochschule Niederrhein, organizationalUnitName=Datenverarbeitungszentrale, commonName=Hochschule Niederrhein CA - G01, emailAddress=pki@hs-niederrhein.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610A6E7885
- SHA-256: 58ABAEBA658ABE3842B515AED680EC8DBDA0DB979CA8DBF4D4D62E989E6C657C
- SPKI SHA-256: 754DC260B2F8616B1AC3938D3B46E3ED857F9FBEA3EC7EB8C25C3E985BCFF189
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670925584517 (0x1790610a6e7885)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:34 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Krefeld, O = Hochschule Niederrhein, OU = Datenverarbeitungszentrale, CN = Hochschule Niederrhein CA - G01, emailAddress = pki@hs-niederrhein.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CA:EE:09:58:33:4A:CD:D7:F1:9A:25:46:3D:68:8F:60:CA:C9:06:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-niederrhein.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 58ABAEBA658ABE3842B515AED680EC8DBDA0DB979CA8DBF4D4D62E989E6C657C
    SPKI SHA256: 754DC260B2F8616B1AC3938D3B46E3ED857F9FBEA3EC7EB8C25C3E985BCFF189
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Niederrhein CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Krefeld, organizationName=Hochschule Niederrhein, organizationalUnitName=Datenverarbeitungszentrale, commonName=Hochschule Niederrhein CA - G01, emailAddress=pki@hs-niederrhein.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC61
- SHA-256: 83288EBB3DD51EF2FA057CC63F42A77FD34A1666BBE4EC0BFF5B0CC1F2A2BA92
- SPKI SHA-256: 754DC260B2F8616B1AC3938D3B46E3ED857F9FBEA3EC7EB8C25C3E985BCFF189
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027553 (0xa31ac61)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:15 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Krefeld, O = Hochschule Niederrhein, OU = Datenverarbeitungszentrale, CN = Hochschule Niederrhein CA - G01, emailAddress = pki@hs-niederrhein.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CA:EE:09:58:33:4A:CD:D7:F1:9A:25:46:3D:68:8F:60:CA:C9:06:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-niederrhein.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 83288EBB3DD51EF2FA057CC63F42A77FD34A1666BBE4EC0BFF5B0CC1F2A2BA92
    SPKI SHA256: 754DC260B2F8616B1AC3938D3B46E3ED857F9FBEA3EC7EB8C25C3E985BCFF189
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Offenburg CA

- Subject: countryName=DE, organizationName=Hochschule Offenburg, commonName=Hochschule Offenburg CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D167ACB
- SHA-256: AABE1BE93F79A3E014B3AA1C4C6057BB59202378C5ED1E91E47509505A93BD7F
- SPKI SHA-256: 1A1ED2BA2CC56646556B1E9742397CD68DEFD4EE9CF87EE094CC3755826CD89D
- Validity: 2008-10-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 219577035 (0xd167acb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 16 08:37:15 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Offenburg, CN = Hochschule Offenburg CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:6A:D6:92:01:03:7C:6D:9A:BC:1A:E0:34:74:55:8C:FB:8C:C5:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AABE1BE93F79A3E014B3AA1C4C6057BB59202378C5ED1E91E47509505A93BD7F
    SPKI SHA256: 1A1ED2BA2CC56646556B1E9742397CD68DEFD4EE9CF87EE094CC3755826CD89D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Offenburg CA

- Subject: countryName=DE, organizationName=Hochschule Offenburg, commonName=Hochschule Offenburg CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69C57C186
- SHA-256: 430B86F36A9BFC8AFE90660FED1B62374257F4B287AE455D8195D456723244D6
- SPKI SHA-256: 1A1ED2BA2CC56646556B1E9742397CD68DEFD4EE9CF87EE094CC3755826CD89D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398184157574 (0x17aff69c57c186)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:01 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Offenburg, CN = Hochschule Offenburg CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:6A:D6:92:01:03:7C:6D:9A:BC:1A:E0:34:74:55:8C:FB:8C:C5:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 430B86F36A9BFC8AFE90660FED1B62374257F4B287AE455D8195D456723244D6
    SPKI SHA256: 1A1ED2BA2CC56646556B1E9742397CD68DEFD4EE9CF87EE094CC3755826CD89D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Osnabrueck CA - G 01

- Subject: countryName=DE, organizationName=Hochschule Osnabrueck, organizationalUnitName=zentrale IT, commonName=Hochschule Osnabrueck CA - G 01, emailAddress=ca@hs-osnabrueck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10DBD7E5
- SHA-256: FE8550C07898E315FFB7D19DD9D031118F47E7A228C73CD5CC612271537C6B9A
- SPKI SHA-256: D5345A07D96623598BC298A8204C052394F8F781DC77CDB367BD2BFAA1EA2670
- Validity: 2010-10-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 282843109 (0x10dbd7e5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 18 14:31:49 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Osnabrueck, OU = zentrale IT, CN = Hochschule Osnabrueck CA - G 01, emailAddress = ca@hs-osnabrueck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                84:3F:C8:AD:98:DC:30:EE:20:FD:51:2B:6C:FA:F2:2D:DA:C4:7D:ED
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-osnabrueck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FE8550C07898E315FFB7D19DD9D031118F47E7A228C73CD5CC612271537C6B9A
    SPKI SHA256: D5345A07D96623598BC298A8204C052394F8F781DC77CDB367BD2BFAA1EA2670
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Hochschule Osnabrueck CA - G 01

- Subject: countryName=DE, organizationName=Hochschule Osnabrueck, organizationalUnitName=zentrale IT, commonName=Hochschule Osnabrueck CA - G 01, emailAddress=ca@hs-osnabrueck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E8FC082A
- SHA-256: 149052EAC60D11DFB367A4B2A467E0D49CE1092FBC24E3C0B87963F607594F48
- SPKI SHA-256: D5345A07D96623598BC298A8204C052394F8F781DC77CDB367BD2BFAA1EA2670
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399469991978 (0x17aff6e8fc082a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:16 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Osnabrueck, OU = zentrale IT, CN = Hochschule Osnabrueck CA - G 01, emailAddress = ca@hs-osnabrueck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                84:3F:C8:AD:98:DC:30:EE:20:FD:51:2B:6C:FA:F2:2D:DA:C4:7D:ED
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-osnabrueck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 149052EAC60D11DFB367A4B2A467E0D49CE1092FBC24E3C0B87963F607594F48
    SPKI SHA256: D5345A07D96623598BC298A8204C052394F8F781DC77CDB367BD2BFAA1EA2670
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Ruhr West CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muelheim an der Ruhr, organizationName=Hochschule Ruhr West, organizationalUnitName=IT Service, commonName=Hochschule Ruhr West CA, emailAddress=admin@hs-rw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E7955C41
- SHA-256: 8B07B8943E678532BFFA9EC630F302CF5EC9674CF5BDD980A0B7B654F90ABEC2
- SPKI SHA-256: 2C46FF9FEF30FA3B1AE35D082E77DBB75F9ED7DC00E314FA405C7C01E1D36E0A
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399446486081 (0x17aff6e7955c41)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:15 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Muelheim an der Ruhr, O = Hochschule Ruhr West, OU = IT Service, CN = Hochschule Ruhr West CA, emailAddress = admin@hs-rw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EE:0C:4C:FA:FC:92:D0:DA:91:E4:FA:DB:76:8B:DF:7C:6E:D9:FE:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admin@hs-rw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8B07B8943E678532BFFA9EC630F302CF5EC9674CF5BDD980A0B7B654F90ABEC2
    SPKI SHA256: 2C46FF9FEF30FA3B1AE35D082E77DBB75F9ED7DC00E314FA405C7C01E1D36E0A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hochschule Ruhr West CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Muelheim an der Ruhr, organizationName=Hochschule Ruhr West, organizationalUnitName=IT Service, commonName=Hochschule Ruhr West CA, emailAddress=admin@hs-rw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10DBD7E0
- SHA-256: E4102AFB585670C3200B722418AFEA33537C537643ED93F4E9D82B6616305329
- SPKI SHA-256: 2C46FF9FEF30FA3B1AE35D082E77DBB75F9ED7DC00E314FA405C7C01E1D36E0A
- Validity: 2010-10-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 282843104 (0x10dbd7e0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 18 14:31:45 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Muelheim an der Ruhr, O = Hochschule Ruhr West, OU = IT Service, CN = Hochschule Ruhr West CA, emailAddress = admin@hs-rw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EE:0C:4C:FA:FC:92:D0:DA:91:E4:FA:DB:76:8B:DF:7C:6E:D9:FE:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:admin@hs-rw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E4102AFB585670C3200B722418AFEA33537C537643ED93F4E9D82B6616305329
    SPKI SHA256: 2C46FF9FEF30FA3B1AE35D082E77DBB75F9ED7DC00E314FA405C7C01E1D36E0A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Anhalt CA - G02

- Subject: countryName=DE, organizationName=Hochschule Anhalt (FH), organizationalUnitName=ZIK, commonName=HS Anhalt CA - G02, emailAddress=ca@hs-anhalt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F10A4E
- SHA-256: D3C88ECC7A4DC5F7AD3D755E39F54CAC82DD0E3ABD0E4E2B212E01FFBE77DF7A
- SPKI SHA-256: AD39FF32218E7BCA8C6032C21A5E9281417D401A77DCEB69F3E51AF489BB3528
- Validity: 2007-02-13 to 2019-02-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166791758 (0x9f10a4e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 13 10:02:40 2007 GMT
            Not After : Feb 12 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Anhalt (FH), OU = ZIK, CN = HS Anhalt CA - G02, emailAddress = ca@hs-anhalt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9B:C1:1E:B0:F0:59:A3:7C:7D:83:4E:93:04:53:20:51:92:F6:4C:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-anhalt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D3C88ECC7A4DC5F7AD3D755E39F54CAC82DD0E3ABD0E4E2B212E01FFBE77DF7A
    SPKI SHA256: AD39FF32218E7BCA8C6032C21A5E9281417D401A77DCEB69F3E51AF489BB3528
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Anhalt CA - G02

- Subject: countryName=DE, organizationName=Hochschule Anhalt (FH), organizationalUnitName=ZIK, commonName=HS Anhalt CA - G02, emailAddress=ca@hs-anhalt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060DDE4415D
- SHA-256: D64FE437DC6023E890976EBA1C5FE7A11845B82D07BC8B14C3B57C549779AD3D
- SPKI SHA-256: AD39FF32218E7BCA8C6032C21A5E9281417D401A77DCEB69F3E51AF489BB3528
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670178328925 (0x179060dde4415d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:49 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Anhalt (FH), OU = ZIK, CN = HS Anhalt CA - G02, emailAddress = ca@hs-anhalt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9B:C1:1E:B0:F0:59:A3:7C:7D:83:4E:93:04:53:20:51:92:F6:4C:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-anhalt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D64FE437DC6023E890976EBA1C5FE7A11845B82D07BC8B14C3B57C549779AD3D
    SPKI SHA256: AD39FF32218E7BCA8C6032C21A5E9281417D401A77DCEB69F3E51AF489BB3528
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Ansbach CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Hochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=HS Ansbach CA, emailAddress=ca@hs-ansbach.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D78C5C5D
- SHA-256: 70D6DAE6F54DD2507E431E1C8AA911AB6DD76C64F30103F2AF6C3E5BD3861166
- SPKI SHA-256: 913E1B3DB7C3FD78490D6DA864F028D0233A34376AD8E579E5ABDA2F88EA0ACE
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399177460829 (0x17aff6d78c5c5d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:59 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ansbach, O = Hochschule Ansbach, OU = Hochschulrechenzentrum, CN = HS Ansbach CA, emailAddress = ca@hs-ansbach.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C5:35:D5:5E:FF:C4:7E:8F:69:1E:4B:7F:A7:E9:F7:46:67:14:E9:7E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-ansbach.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 70D6DAE6F54DD2507E431E1C8AA911AB6DD76C64F30103F2AF6C3E5BD3861166
    SPKI SHA256: 913E1B3DB7C3FD78490D6DA864F028D0233A34376AD8E579E5ABDA2F88EA0ACE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Ansbach CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Ansbach, organizationName=Hochschule Ansbach, organizationalUnitName=Hochschulrechenzentrum, commonName=HS Ansbach CA, emailAddress=ca@hs-ansbach.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FF522FE
- SHA-256: 0444BAF049BC457A02EC3C0F32225E66CFF0D8A83DBA713A9E643F45E6EF880C
- SPKI SHA-256: 913E1B3DB7C3FD78490D6DA864F028D0233A34376AD8E579E5ABDA2F88EA0ACE
- Validity: 2010-04-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 267723518 (0xff522fe)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 26 14:38:38 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Ansbach, O = Hochschule Ansbach, OU = Hochschulrechenzentrum, CN = HS Ansbach CA, emailAddress = ca@hs-ansbach.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C5:35:D5:5E:FF:C4:7E:8F:69:1E:4B:7F:A7:E9:F7:46:67:14:E9:7E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-ansbach.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0444BAF049BC457A02EC3C0F32225E66CFF0D8A83DBA713A9E643F45E6EF880C
    SPKI SHA256: 913E1B3DB7C3FD78490D6DA864F028D0233A34376AD8E579E5ABDA2F88EA0ACE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Bochum CA - G01

- Subject: countryName=DE, organizationName=Hochschule Bochum, commonName=HS Bochum CA - G01, emailAddress=ca@hs-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71243C025
- SHA-256: 66316D9D7F2FA18E76B09485AB514491A3211CBE057652B776926C6F1BABACAF
- SPKI SHA-256: 2047141A093C0B780EEE991D91C49513B72170815E525DD5B9C74BD730AC4F9A
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400162557989 (0x17aff71243c025)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Bochum, CN = HS Bochum CA - G01, emailAddress = ca@hs-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                30:9F:A2:F3:0C:99:54:5B:93:FA:93:19:97:58:5D:F3:18:04:C3:9B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 66316D9D7F2FA18E76B09485AB514491A3211CBE057652B776926C6F1BABACAF
    SPKI SHA256: 2047141A093C0B780EEE991D91C49513B72170815E525DD5B9C74BD730AC4F9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Bochum CA - G01

- Subject: countryName=DE, organizationName=Hochschule Bochum, commonName=HS Bochum CA - G01, emailAddress=ca@hs-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 151CAD29B86CF2
- SHA-256: 7B6AE0E05FFC95BAD1F8CC189137565A0143E11213FF602B9CB3F92B35437B65
- SPKI SHA-256: 2047141A093C0B780EEE991D91C49513B72170815E525DD5B9C74BD730AC4F9A
- Validity: 2013-01-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5942504565796082 (0x151cad29b86cf2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 21 12:07:54 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Bochum, CN = HS Bochum CA - G01, emailAddress = ca@hs-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                30:9F:A2:F3:0C:99:54:5B:93:FA:93:19:97:58:5D:F3:18:04:C3:9B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7B6AE0E05FFC95BAD1F8CC189137565A0143E11213FF602B9CB3F92B35437B65
    SPKI SHA256: 2047141A093C0B780EEE991D91C49513B72170815E525DD5B9C74BD730AC4F9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Fulda CA - G02

- Subject: countryName=DE, organizationName=Hochschule Fulda, organizationalUnitName=Datenverarbeitungszentrum, commonName=HS Fulda CA - G02, emailAddress=pki@hs-fulda.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A74CDBE
- SHA-256: 831C09D11CA18F18A83A01AF091F8073A111C5049D0BF2DA43F347E029A47481
- SPKI SHA-256: A5E0F7CDA733D07CCE73B98861B9840824884F3794B7DF0BB1626C8ABD0B32A7
- Validity: 2007-05-24 to 2019-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175427006 (0xa74cdbe)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 24 08:43:28 2007 GMT
            Not After : May 23 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Fulda, OU = Datenverarbeitungszentrum, CN = HS Fulda CA - G02, emailAddress = pki@hs-fulda.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F9:F5:CB:8C:4C:5E:59:06:F3:FD:13:50:2B:E7:75:F4:58:28:53:D7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-fulda.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 831C09D11CA18F18A83A01AF091F8073A111C5049D0BF2DA43F347E029A47481
    SPKI SHA256: A5E0F7CDA733D07CCE73B98861B9840824884F3794B7DF0BB1626C8ABD0B32A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Fulda CA - G02

- Subject: countryName=DE, organizationName=Hochschule Fulda, organizationalUnitName=Datenverarbeitungszentrum, commonName=HS Fulda CA - G02, emailAddress=pki@hs-fulda.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424734A1D96
- SHA-256: 2523F539E7D3C5F13AD173C6DF8C68627C1DC55EA42B07742D3E0BE0FD73799F
- SPKI SHA-256: A5E0F7CDA733D07CCE73B98861B9840824884F3794B7DF0BB1626C8ABD0B32A7
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400924360086 (0x17a424734a1d96)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Fulda, OU = Datenverarbeitungszentrum, CN = HS Fulda CA - G02, emailAddress = pki@hs-fulda.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F9:F5:CB:8C:4C:5E:59:06:F3:FD:13:50:2B:E7:75:F4:58:28:53:D7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-fulda.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2523F539E7D3C5F13AD173C6DF8C68627C1DC55EA42B07742D3E0BE0FD73799F
    SPKI SHA256: A5E0F7CDA733D07CCE73B98861B9840824884F3794B7DF0BB1626C8ABD0B32A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Geisenheim CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Geisenheim, organizationName=Hochschule Geisenheim, commonName=HS Geisenheim CA - G01, emailAddress=ca@hs-gm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7140A3F73
- SHA-256: 52242923D38D1A31B277392430D0BE2EEAA3AA1042B54DE6CE09C0DBC4DC7C9D
- SPKI SHA-256: CB0E8ACD1535197A815258805924B1B1D0FFA21ABF0935B5062A04BC8051F248
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400192343923 (0x17aff7140a3f73)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Geisenheim, O = Hochschule Geisenheim, CN = HS Geisenheim CA - G01, emailAddress = ca@hs-gm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:4C:10:B1:42:F3:B6:5D:25:07:9C:D1:D2:3E:0F:74:4D:89:F8:B3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-gm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52242923D38D1A31B277392430D0BE2EEAA3AA1042B54DE6CE09C0DBC4DC7C9D
    SPKI SHA256: CB0E8ACD1535197A815258805924B1B1D0FFA21ABF0935B5062A04BC8051F248
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Geisenheim CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Geisenheim, organizationName=Hochschule Geisenheim, commonName=HS Geisenheim CA - G01, emailAddress=ca@hs-gm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1567D8891ACFAE
- SHA-256: 01C4846E9B26ABC286D57CF506DF96034FA63B90D53541C9D9C2A2996EDB297D
- SPKI SHA-256: CB0E8ACD1535197A815258805924B1B1D0FFA21ABF0935B5062A04BC8051F248
- Validity: 2013-03-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6025154221756334 (0x1567d8891acfae)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 19 12:32:58 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Geisenheim, O = Hochschule Geisenheim, CN = HS Geisenheim CA - G01, emailAddress = ca@hs-gm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:4C:10:B1:42:F3:B6:5D:25:07:9C:D1:D2:3E:0F:74:4D:89:F8:B3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-gm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 01C4846E9B26ABC286D57CF506DF96034FA63B90D53541C9D9C2A2996EDB297D
    SPKI SHA256: CB0E8ACD1535197A815258805924B1B1D0FFA21ABF0935B5062A04BC8051F248
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Hannover CA - G01

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Hochschule Hannover, commonName=HS Hannover CA - G01, emailAddress=pki@hs-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1840DC02806EC8
- SHA-256: D1AB19756EED00960DA92DDAC2BE6806ADD76D588E10769FEB5249A53B781B21
- SPKI SHA-256: E644566C5E9BF5D4DEF82B6D32F0C7C32DFB3688D602667E34A42FD85C0F8847
- Validity: 2014-09-23 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6826713120009928 (0x1840dc02806ec8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 23 11:50:11 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Hochschule Hannover, CN = HS Hannover CA - G01, emailAddress = pki@hs-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                D0:7F:F4:D9:CD:47:C1:0F:D7:07:A7:D0:0F:07:E8:1F:EE:5A:CA:C9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1AB19756EED00960DA92DDAC2BE6806ADD76D588E10769FEB5249A53B781B21
    SPKI SHA256: E644566C5E9BF5D4DEF82B6D32F0C7C32DFB3688D602667E34A42FD85C0F8847
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Kehl CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Kehl, organizationName=Hochschule fuer oeffentliche Verwaltung Kehl, commonName=HS Kehl CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181AB541784ED6
- SHA-256: 846F842CDC562DA890D5E04D70F61E3AB9811D34F88F39C098BE52AFA72AC761
- SPKI SHA-256: 24663BEECF8856C85E418D993805ABFD514A360460BEF1F12A0B4C8A048440C2
- Validity: 2014-08-25 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6784765230862038 (0x181ab541784ed6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 25 13:18:42 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Kehl, O = Hochschule fuer oeffentliche Verwaltung Kehl, CN = HS Kehl CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                C2:79:CE:07:67:51:6F:A4:55:04:7E:F9:02:3E:34:07:FB:29:57:16
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 846F842CDC562DA890D5E04D70F61E3AB9811D34F88F39C098BE52AFA72AC761
    SPKI SHA256: 24663BEECF8856C85E418D993805ABFD514A360460BEF1F12A0B4C8A048440C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Kempten CA

- Subject: countryName=DE, organizationName=Hochschule Kempten, commonName=HS Kempten CA, emailAddress=pki@fh-kempten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D49F6F8
- SHA-256: 4847A5A8A339E3789F603A01B76C3C9CA9A77D5FE1A3A7A3C61A544255987153
- SPKI SHA-256: 71EB69B21E33C217F51917D91404E82A9F8192BCA3A5AD7E86F4D2D077471750
- Validity: 2008-11-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 222951160 (0xd49f6f8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 24 09:52:40 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Kempten, CN = HS Kempten CA, emailAddress = pki@fh-kempten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B3:8D:01:56:54:67:35:4F:39:A9:6E:15:7C:30:44:B9:F2:07:DA:B4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-kempten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4847A5A8A339E3789F603A01B76C3C9CA9A77D5FE1A3A7A3C61A544255987153
    SPKI SHA256: 71EB69B21E33C217F51917D91404E82A9F8192BCA3A5AD7E86F4D2D077471750
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Kempten CA

- Subject: countryName=DE, organizationName=Hochschule Kempten, commonName=HS Kempten CA, emailAddress=pki@fh-kempten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A02DBFF7
- SHA-256: 61F1A59BF91B0A206180B67A7F3CA942066BB76BBB5F1B30679F1F04DE43CCC1
- SPKI SHA-256: 71EB69B21E33C217F51917D91404E82A9F8192BCA3A5AD7E86F4D2D077471750
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398248513527 (0x17aff6a02dbff7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:04 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Kempten, CN = HS Kempten CA, emailAddress = pki@fh-kempten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B3:8D:01:56:54:67:35:4F:39:A9:6E:15:7C:30:44:B9:F2:07:DA:B4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-kempten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 61F1A59BF91B0A206180B67A7F3CA942066BB76BBB5F1B30679F1F04DE43CCC1
    SPKI SHA256: 71EB69B21E33C217F51917D91404E82A9F8192BCA3A5AD7E86F4D2D077471750
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Ludwigsburg CA - G01

- Subject: countryName=DE, organizationName=Hochschule fuer oeffentliche Verwaltung und Finanzen Ludwigsburg, organizationalUnitName=Zentrum fuer Medien und Informationstechnologie, commonName=HS Ludwigsburg CA - G01, emailAddress=ca@hs-ludwigsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94DDD5EA97
- SHA-256: 0002F8004BCF2A13CF51DD9BF2E4C68A84FD9CBF33E30482FFCF2A8C5AB0AA57
- SPKI SHA-256: 62622AF32D30044738882ECF6BCAC2CE700615A3F76F3DF4B6DB9970B9E0F0DB
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612002794760855 (0x177d94ddd5ea97)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:37 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer oeffentliche Verwaltung und Finanzen Ludwigsburg, OU = Zentrum fuer Medien und Informationstechnologie, CN = HS Ludwigsburg CA - G01, emailAddress = ca@hs-ludwigsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                41:D5:D4:7F:BE:EF:BA:26:B3:8D:65:33:D3:EA:B1:CE:14:4E:40:FD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-ludwigsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0002F8004BCF2A13CF51DD9BF2E4C68A84FD9CBF33E30482FFCF2A8C5AB0AA57
    SPKI SHA256: 62622AF32D30044738882ECF6BCAC2CE700615A3F76F3DF4B6DB9970B9E0F0DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Magdeburg Stendal (FH) CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Magdeburg, organizationName=Hochschule Magdeburg Stendal (FH), commonName=HS Magdeburg Stendal (FH) CA - G01, emailAddress=pki@hs-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A3C0CD2
- SHA-256: D89DBF20AD67B71A7513DE5234FB948E7D02D82A3DE77477B9A88D93D16A949A
- SPKI SHA-256: 309E464552EB60753244A0FB9F8C1FD217D55D877E7B9F76CCF0CEC33C4421E1
- Validity: 2007-04-11 to 2019-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171707602 (0xa3c0cd2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 07:33:23 2007 GMT
            Not After : Apr  9 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Magdeburg, O = Hochschule Magdeburg Stendal (FH), CN = HS Magdeburg Stendal (FH) CA - G01, emailAddress = pki@hs-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                39:BC:70:CC:1E:88:1D:FB:1D:84:DE:A3:3A:72:EA:09:37:53:7B:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D89DBF20AD67B71A7513DE5234FB948E7D02D82A3DE77477B9A88D93D16A949A
    SPKI SHA256: 309E464552EB60753244A0FB9F8C1FD217D55D877E7B9F76CCF0CEC33C4421E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Magdeburg Stendal (FH) CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Magdeburg, organizationName=Hochschule Magdeburg Stendal (FH), commonName=HS Magdeburg Stendal (FH) CA - G01, emailAddress=pki@hs-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179061112E33C8
- SHA-256: C4C7271AEB7B163EBFD89C246AB52B9F73BBB7CB2A4CBA009ABC8F31DD536AF3
- SPKI SHA-256: 309E464552EB60753244A0FB9F8C1FD217D55D877E7B9F76CCF0CEC33C4421E1
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671038813128 (0x179061112e33c8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:42 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Magdeburg, O = Hochschule Magdeburg Stendal (FH), CN = HS Magdeburg Stendal (FH) CA - G01, emailAddress = pki@hs-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                39:BC:70:CC:1E:88:1D:FB:1D:84:DE:A3:3A:72:EA:09:37:53:7B:E3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C4C7271AEB7B163EBFD89C246AB52B9F73BBB7CB2A4CBA009ABC8F31DD536AF3
    SPKI SHA256: 309E464552EB60753244A0FB9F8C1FD217D55D877E7B9F76CCF0CEC33C4421E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Mannheim CA

- Subject: countryName=DE, organizationName=Hochschule Mannheim, commonName=HS Mannheim CA, emailAddress=pki@hs-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424AAA79D4B
- SHA-256: 7DFE65BD9CEAA5C486F00971AF62880DB73BCBF2AF0B6274EF13CA34FA3950B0
- SPKI SHA-256: 9221140FA9998CFD2435ED48D652CAFA51EAC6EE406D2B35CE5D5ABFFC08DF90
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401853234507 (0x17a424aaa79d4b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Mannheim, CN = HS Mannheim CA, emailAddress = pki@hs-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                15:6A:CA:A0:51:B3:B8:9E:87:18:95:5F:3C:49:E5:A7:5A:F3:A5:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7DFE65BD9CEAA5C486F00971AF62880DB73BCBF2AF0B6274EF13CA34FA3950B0
    SPKI SHA256: 9221140FA9998CFD2435ED48D652CAFA51EAC6EE406D2B35CE5D5ABFFC08DF90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Mannheim CA

- Subject: countryName=DE, organizationName=Hochschule Mannheim, commonName=HS Mannheim CA, emailAddress=pki@hs-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE3686D
- SHA-256: 66180DEBB5642659CACB699F222F48FFBB9EA64D577F99B1E3242E211F5E61F0
- SPKI SHA-256: 9221140FA9998CFD2435ED48D652CAFA51EAC6EE406D2B35CE5D5ABFFC08DF90
- Validity: 2008-02-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199452781 (0xbe3686d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 10:33:03 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Mannheim, CN = HS Mannheim CA, emailAddress = pki@hs-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                15:6A:CA:A0:51:B3:B8:9E:87:18:95:5F:3C:49:E5:A7:5A:F3:A5:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 66180DEBB5642659CACB699F222F48FFBB9EA64D577F99B1E3242E211F5E61F0
    SPKI SHA256: 9221140FA9998CFD2435ED48D652CAFA51EAC6EE406D2B35CE5D5ABFFC08DF90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Merseburg CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Merseburg, organizationName=Hochschule Merseburg (FH), organizationalUnitName=Rechenzentrum, commonName=HS Merseburg CA, emailAddress=pki@hs-merseburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ED2B71E
- SHA-256: 2FD13CB6C340900847419CA64A5BD4B02A6B773DAF1B40B8C4ACE94B1FBE39E0
- SPKI SHA-256: 53C0083B38B0C546D41D6B14628E50877FE00FE87ABF8D07EA4DAF7FB04244C3
- Validity: 2009-09-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 248690462 (0xed2b71e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 18 07:41:02 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Merseburg, O = Hochschule Merseburg (FH), OU = Rechenzentrum, CN = HS Merseburg CA, emailAddress = pki@hs-merseburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                52:BF:FD:E1:4D:2B:F1:47:46:F9:89:86:06:84:EE:49:17:8C:B0:7B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-merseburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2FD13CB6C340900847419CA64A5BD4B02A6B773DAF1B40B8C4ACE94B1FBE39E0
    SPKI SHA256: 53C0083B38B0C546D41D6B14628E50877FE00FE87ABF8D07EA4DAF7FB04244C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS Merseburg CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Merseburg, organizationName=Hochschule Merseburg (FH), organizationalUnitName=Rechenzentrum, commonName=HS Merseburg CA, emailAddress=pki@hs-merseburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6BDFE73A1
- SHA-256: 365FCD6CF4553CC40E3A0ED28534A73D4F8F1377152BCC0010B76D2BB9DA41D6
- SPKI SHA-256: 53C0083B38B0C546D41D6B14628E50877FE00FE87ABF8D07EA4DAF7FB04244C3
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398748730273 (0x17aff6bdfe73a1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:34 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Merseburg, O = Hochschule Merseburg (FH), OU = Rechenzentrum, CN = HS Merseburg CA, emailAddress = pki@hs-merseburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                52:BF:FD:E1:4D:2B:F1:47:46:F9:89:86:06:84:EE:49:17:8C:B0:7B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-merseburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 365FCD6CF4553CC40E3A0ED28534A73D4F8F1377152BCC0010B76D2BB9DA41D6
    SPKI SHA256: 53C0083B38B0C546D41D6B14628E50877FE00FE87ABF8D07EA4DAF7FB04244C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS NB - CA - G02

- Subject: countryName=DE, organizationName=Hochschule Neubrandenburg, organizationalUnitName=Hochschulrechenzentrum, commonName=HS NB - CA - G02, emailAddress=pki@hs-nb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060FBF38C9B
- SHA-256: 91311DE2EE949913BEFB73594A38CEA76E50ABC819F2CA6896E837B903701EE4
- SPKI SHA-256: C245A434D9862679913FFAF27B6A029433A4731B92BC586A014C05801734DCF5
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670682647707 (0x179060fbf38c9b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:20 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Neubrandenburg, OU = Hochschulrechenzentrum, CN = HS NB - CA - G02, emailAddress = pki@hs-nb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0E:A3:F2:E7:92:83:84:D7:A7:50:BC:CC:B9:E3:CF:8A:D3:9D:34:9E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-nb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91311DE2EE949913BEFB73594A38CEA76E50ABC819F2CA6896E837B903701EE4
    SPKI SHA256: C245A434D9862679913FFAF27B6A029433A4731B92BC586A014C05801734DCF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS NB - CA - G02

- Subject: countryName=DE, organizationName=Hochschule Neubrandenburg, organizationalUnitName=Hochschulrechenzentrum, commonName=HS NB - CA - G02, emailAddress=pki@hs-nb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A17432D
- SHA-256: FDC22D00121F8D8973B3536FAB006F86E1B240B8909601BC2CEFD306AA64921B
- SPKI SHA-256: C245A434D9862679913FFAF27B6A029433A4731B92BC586A014C05801734DCF5
- Validity: 2007-03-14 to 2019-03-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169296685 (0xa17432d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 14 09:51:26 2007 GMT
            Not After : Mar 13 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Neubrandenburg, OU = Hochschulrechenzentrum, CN = HS NB - CA - G02, emailAddress = pki@hs-nb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0E:A3:F2:E7:92:83:84:D7:A7:50:BC:CC:B9:E3:CF:8A:D3:9D:34:9E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-nb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FDC22D00121F8D8973B3536FAB006F86E1B240B8909601BC2CEFD306AA64921B
    SPKI SHA256: C245A434D9862679913FFAF27B6A029433A4731B92BC586A014C05801734DCF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS OWL CA - G01

- Subject: countryName=DE, organizationName=Hochschule Ostwestfalen-Lippe, commonName=HS OWL CA - G01, emailAddress=ca@hs-owl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C2C05F1
- SHA-256: B502BD265DBE6EC16DF912579567B89F31A80008B812FC5FF2ED45CF7FBAD35B
- SPKI SHA-256: D807F8CD85D00341639AB2410282CC48AF1C3BF465F86606057B3CB41E544E34
- Validity: 2008-04-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 204211697 (0xc2c05f1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 21 12:28:17 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Ostwestfalen-Lippe, CN = HS OWL CA - G01, emailAddress = ca@hs-owl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4A:8D:E0:BF:D8:E3:29:D0:C1:2F:DC:50:40:4D:BA:A7:C7:7B:C9:7F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-owl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B502BD265DBE6EC16DF912579567B89F31A80008B812FC5FF2ED45CF7FBAD35B
    SPKI SHA256: D807F8CD85D00341639AB2410282CC48AF1C3BF465F86606057B3CB41E544E34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS OWL CA - G01

- Subject: countryName=DE, organizationName=Hochschule Ostwestfalen-Lippe, commonName=HS OWL CA - G01, emailAddress=ca@hs-owl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B991D00C
- SHA-256: 9F81EC83F63CD42B0B9A2F0B25CFE910774CA770505C1635E3BA1606386EB058
- SPKI SHA-256: D807F8CD85D00341639AB2410282CC48AF1C3BF465F86606057B3CB41E544E34
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402103463948 (0x17a424b991d00c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:33 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Ostwestfalen-Lippe, CN = HS OWL CA - G01, emailAddress = ca@hs-owl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4A:8D:E0:BF:D8:E3:29:D0:C1:2F:DC:50:40:4D:BA:A7:C7:7B:C9:7F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-owl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9F81EC83F63CD42B0B9A2F0B25CFE910774CA770505C1635E3BA1606386EB058
    SPKI SHA256: D807F8CD85D00341639AB2410282CC48AF1C3BF465F86606057B3CB41E544E34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Reutlingen CA - G01

- Subject: countryName=DE, organizationName=Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, commonName=HS Reutlingen CA - G01, emailAddress=ca@reutlingen-university.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71E67B5B7
- SHA-256: 9D233CC03E7943D3BA991764F4A6E9FF96BB796E535AA6829F0BAA710C2BCCD9
- SPKI SHA-256: 97F098AC34F2289CFB628CE5012FBA97C29FF5CE11C4A626DD92EAF98415346F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400366241207 (0x17aff71e67b5b7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:10 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, CN = HS Reutlingen CA - G01, emailAddress = ca@reutlingen-university.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:1E:10:AC:C3:E3:0E:EF:54:6F:F0:45:BD:4A:A9:82:12:C6:24:39
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@reutlingen-university.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D233CC03E7943D3BA991764F4A6E9FF96BB796E535AA6829F0BAA710C2BCCD9
    SPKI SHA256: 97F098AC34F2289CFB628CE5012FBA97C29FF5CE11C4A626DD92EAF98415346F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS Reutlingen CA - G01

- Subject: countryName=DE, organizationName=Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, commonName=HS Reutlingen CA - G01, emailAddress=ca@reutlingen-university.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 16D0F41EEF61BA
- SHA-256: CB19DED5CBBF55499B5A58088DE0D02CF7A5194184ECA2C3AE676FDF0C47EC4D
- SPKI SHA-256: 97F098AC34F2289CFB628CE5012FBA97C29FF5CE11C4A626DD92EAF98415346F
- Validity: 2013-12-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6422196397236666 (0x16d0f41eef61ba)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 18 10:18:54 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Reutlingen - Technik-Wirtschaft-Informatik-Design, CN = HS Reutlingen CA - G01, emailAddress = ca@reutlingen-university.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:1E:10:AC:C3:E3:0E:EF:54:6F:F0:45:BD:4A:A9:82:12:C6:24:39
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@reutlingen-university.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CB19DED5CBBF55499B5A58088DE0D02CF7A5194184ECA2C3AE676FDF0C47EC4D
    SPKI SHA256: 97F098AC34F2289CFB628CE5012FBA97C29FF5CE11C4A626DD92EAF98415346F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-Aalen-CA-G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Aalen, organizationName=Hochschule Aalen, commonName=HS-Aalen-CA-G01, emailAddress=pki@htw-aalen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF762DE7271
- SHA-256: 7C612598CDA8F1AE63FBC055343632B7F97BADD60FBCA9E41FC5EF9409D8D865
- SPKI SHA-256: 974F4E04F98E2859A6534FC0EA46A371A51B05AAD0DCCC79EC03CDDC5F787E53
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401514873457 (0x17aff762de7271)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:19 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Aalen, O = Hochschule Aalen, CN = HS-Aalen-CA-G01, emailAddress = pki@htw-aalen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0D:E7:F1:E5:C3:6B:F5:3C:D3:EF:16:BE:77:B4:3C:8D:D0:43:99:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htw-aalen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7C612598CDA8F1AE63FBC055343632B7F97BADD60FBCA9E41FC5EF9409D8D865
    SPKI SHA256: 974F4E04F98E2859A6534FC0EA46A371A51B05AAD0DCCC79EC03CDDC5F787E53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-Aalen-CA-G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Aalen, organizationName=Hochschule Aalen, commonName=HS-Aalen-CA-G01, emailAddress=pki@htw-aalen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D9673D0
- SHA-256: 6F77E8C27CE1711FF44079C91137F03CAC68C2F6FA92AA8CA65E883A16444F9D
- SPKI SHA-256: 974F4E04F98E2859A6534FC0EA46A371A51B05AAD0DCCC79EC03CDDC5F787E53
- Validity: 2009-01-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 227963856 (0xd9673d0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 21 10:17:36 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Aalen, O = Hochschule Aalen, CN = HS-Aalen-CA-G01, emailAddress = pki@htw-aalen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0D:E7:F1:E5:C3:6B:F5:3C:D3:EF:16:BE:77:B4:3C:8D:D0:43:99:11
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htw-aalen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6F77E8C27CE1711FF44079C91137F03CAC68C2F6FA92AA8CA65E883A16444F9D
    SPKI SHA256: 974F4E04F98E2859A6534FC0EA46A371A51B05AAD0DCCC79EC03CDDC5F787E53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-EL CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, organizationName=Hochschule Emden/Leer, commonName=HS-EL CA, emailAddress=pki@hs-emden-leer.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FA271E34
- SHA-256: 258807262E3A390911DAFCDA5A9D314FAF444FE6718239B40EECAB1816367E0F
- SPKI SHA-256: 2AE35AA2687E70F8A0BDAFA8FF84712AE5CC1BD488A67A02AB63F2E405AA0D9E
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399758028340 (0x17aff6fa271e34)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:34 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, O = Hochschule Emden/Leer, CN = HS-EL CA, emailAddress = pki@hs-emden-leer.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B5:8E:C1:94:C8:8B:7A:59:6E:41:8A:97:D4:1B:27:59:0B:D2:F2:CF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-emden-leer.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 258807262E3A390911DAFCDA5A9D314FAF444FE6718239B40EECAB1816367E0F
    SPKI SHA256: 2AE35AA2687E70F8A0BDAFA8FF84712AE5CC1BD488A67A02AB63F2E405AA0D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-EL CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, organizationName=Hochschule Emden/Leer, commonName=HS-EL CA, emailAddress=pki@hs-emden-leer.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12BF64DAA34613
- SHA-256: 4DEBD9DFA18EE9122FAFC1DB91C5D55EA86425577DD985E5CA06BAD2D71D37A8
- SPKI SHA-256: 2AE35AA2687E70F8A0BDAFA8FF84712AE5CC1BD488A67A02AB63F2E405AA0D9E
- Validity: 2011-10-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5276989466560019 (0x12bf64daa34613)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 20 09:18:02 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, O = Hochschule Emden/Leer, CN = HS-EL CA, emailAddress = pki@hs-emden-leer.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B5:8E:C1:94:C8:8B:7A:59:6E:41:8A:97:D4:1B:27:59:0B:D2:F2:CF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-emden-leer.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4DEBD9DFA18EE9122FAFC1DB91C5D55EA86425577DD985E5CA06BAD2D71D37A8
    SPKI SHA256: 2AE35AA2687E70F8A0BDAFA8FF84712AE5CC1BD488A67A02AB63F2E405AA0D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-Harz-CA

- Subject: countryName=DE, organizationName=HS-Harz, commonName=HS-Harz-CA, emailAddress=CA@hs-harz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A207AF6
- SHA-256: 310E020602C5D8565D24188F0E66A4027E6E841E32F718B3DA3C95A6494D2537
- SPKI SHA-256: F70CF5DB2F8A6350B74C835CA6A6A6DCA318BE2F4BBF0978E5625E0B883C17E6
- Validity: 2007-03-21 to 2019-03-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169900790 (0xa207af6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 21 09:39:52 2007 GMT
            Not After : Mar 20 00:00:00 2019 GMT
        Subject: C = DE, O = HS-Harz, CN = HS-Harz-CA, emailAddress = CA@hs-harz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CC:F4:9B:FE:8B:41:E3:59:3D:F1:36:0E:98:2D:F0:BD:17:1A:4A:15
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@hs-harz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 310E020602C5D8565D24188F0E66A4027E6E841E32F718B3DA3C95A6494D2537
    SPKI SHA256: F70CF5DB2F8A6350B74C835CA6A6A6DCA318BE2F4BBF0978E5625E0B883C17E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-Harz-CA

- Subject: countryName=DE, organizationName=HS-Harz, commonName=HS-Harz-CA, emailAddress=CA@hs-harz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4255FCF0C44
- SHA-256: E4E557D28B8B6C84A973869A0E57323BB0760899C758AC1734ABBAAA56FDD3AC
- SPKI SHA-256: F70CF5DB2F8A6350B74C835CA6A6A6DCA318BE2F4BBF0978E5625E0B883C17E6
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404892494916 (0x17a4255fcf0c44)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:19 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = HS-Harz, CN = HS-Harz-CA, emailAddress = CA@hs-harz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CC:F4:9B:FE:8B:41:E3:59:3D:F1:36:0E:98:2D:F0:BD:17:1A:4A:15
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@hs-harz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E4E557D28B8B6C84A973869A0E57323BB0760899C758AC1734ABBAAA56FDD3AC
    SPKI SHA256: F70CF5DB2F8A6350B74C835CA6A6A6DCA318BE2F4BBF0978E5625E0B883C17E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-Ulm-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ulm, organizationName=Hochschule Ulm, commonName=HS-Ulm-CA, emailAddress=pki@hs-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BA56F0A
- SHA-256: 08F5DFC65D1601A7710C0C003919233970585F92A3114160965BE9B7D376D1AD
- SPKI SHA-256: 14EDF24C3C462DF913204115474BCD7FD6D3D59720EA5AEBC1586E3E76BEC43D
- Validity: 2008-01-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 195391242 (0xba56f0a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 10 10:20:44 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ulm, O = Hochschule Ulm, CN = HS-Ulm-CA, emailAddress = pki@hs-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8A:90:D4:29:9E:99:98:F9:C7:AC:E4:E0:1C:A4:0E:B2:A5:34:C7:8F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 08F5DFC65D1601A7710C0C003919233970585F92A3114160965BE9B7D376D1AD
    SPKI SHA256: 14EDF24C3C462DF913204115474BCD7FD6D3D59720EA5AEBC1586E3E76BEC43D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-Ulm-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ulm, organizationName=Hochschule Ulm, commonName=HS-Ulm-CA, emailAddress=pki@hs-ulm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424E63BCDC8
- SHA-256: D7478EBC824662E60A427AA38EDE207C02CA811470B981EFD1EEC9904115B36B
- SPKI SHA-256: 14EDF24C3C462DF913204115474BCD7FD6D3D59720EA5AEBC1586E3E76BEC43D
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402852801992 (0x17a424e63bcdc8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ulm, O = Hochschule Ulm, CN = HS-Ulm-CA, emailAddress = pki@hs-ulm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8A:90:D4:29:9E:99:98:F9:C7:AC:E4:E0:1C:A4:0E:B2:A5:34:C7:8F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-ulm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7478EBC824662E60A427AA38EDE207C02CA811470B981EFD1EEC9904115B36B
    SPKI SHA256: 14EDF24C3C462DF913204115474BCD7FD6D3D59720EA5AEBC1586E3E76BEC43D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-WGT-CA-G02

- Subject: countryName=DE, organizationName=Hochschule Ravensburg-Weingarten, commonName=HS-WGT-CA-G02, emailAddress=hs-wgt-ca@hs-weingarten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A02234A
- SHA-256: EB4BAD10992FCDB50CD09BAE393F64D28A13B29153106E1DA4A31B6401A674CF
- SPKI SHA-256: DAB2B3E4689BACA6F26545A71AF71256A588C670CFE39A1E2F745412EB389D2E
- Validity: 2007-02-26 to 2019-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167912266 (0xa02234a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 09:17:48 2007 GMT
            Not After : Feb 25 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Ravensburg-Weingarten, CN = HS-WGT-CA-G02, emailAddress = hs-wgt-ca@hs-weingarten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C4:AD:9B:28:CD:B1:26:FA:CA:AB:9E:A0:FB:0E:8D:6F:BE:1A:5A:F0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hs-wgt-ca@hs-weingarten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EB4BAD10992FCDB50CD09BAE393F64D28A13B29153106E1DA4A31B6401A674CF
    SPKI SHA256: DAB2B3E4689BACA6F26545A71AF71256A588C670CFE39A1E2F745412EB389D2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-WGT-CA-G02

- Subject: countryName=DE, organizationName=Hochschule Ravensburg-Weingarten, commonName=HS-WGT-CA-G02, emailAddress=hs-wgt-ca@hs-weingarten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4256F5483D0
- SHA-256: B465F4C2BBC35C18683ACB98E7D91292BD7C7B7807C787A6CC78FAB5577547A0
- SPKI SHA-256: DAB2B3E4689BACA6F26545A71AF71256A588C670CFE39A1E2F745412EB389D2E
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654405152900048 (0x17a4256f5483d0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Ravensburg-Weingarten, CN = HS-WGT-CA-G02, emailAddress = hs-wgt-ca@hs-weingarten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C4:AD:9B:28:CD:B1:26:FA:CA:AB:9E:A0:FB:0E:8D:6F:BE:1A:5A:F0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hs-wgt-ca@hs-weingarten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B465F4C2BBC35C18683ACB98E7D91292BD7C7B7807C787A6CC78FAB5577547A0
    SPKI SHA256: DAB2B3E4689BACA6F26545A71AF71256A588C670CFE39A1E2F745412EB389D2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-WOE CA - G01

- Subject: countryName=DE, organizationName=Hochschule Wilhelmshaven/Oldenburg/Elsfleth, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10078C61
- SHA-256: 26BC5A4896F053D58DD1A5074C0E41DAFA760581C7E763B7E1F8F276FD17BF7E
- SPKI SHA-256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
- Validity: 2010-05-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 268930145 (0x10078c61)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 10 13:49:05 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Wilhelmshaven/Oldenburg/Elsfleth, CN = HS-WOE CA - G01, emailAddress = pki@hs-woe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3A:37:3A:64:BA:95:5B:11:E7:85:B4:DB:04:72:DD:FA:84:19:F7:9B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-woe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 26BC5A4896F053D58DD1A5074C0E41DAFA760581C7E763B7E1F8F276FD17BF7E
    SPKI SHA256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-WOE CA - G01

- Subject: countryName=DE, organizationName=Hochschule Wilhelmshaven/Oldenburg/Elsfleth, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DAA216A3
- SHA-256: F52095E40316724206D16E4F34A6D1F90D2EFFA8D54ED2919D1B59BCD88815F0
- SPKI SHA-256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399229216419 (0x17aff6daa216a3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Wilhelmshaven/Oldenburg/Elsfleth, CN = HS-WOE CA - G01, emailAddress = pki@hs-woe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3A:37:3A:64:BA:95:5B:11:E7:85:B4:DB:04:72:DD:FA:84:19:F7:9B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-woe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F52095E40316724206D16E4F34A6D1F90D2EFFA8D54ED2919D1B59BCD88815F0
    SPKI SHA256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-WOE CA - G01

- Subject: countryName=DE, organizationName=Hochschule Wilhelmshaven, commonName=HS-WOE CA - G01, emailAddress=pki@hs-woe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10076668
- SHA-256: C791B500A6A0C4E85568EE2E91D8F46B19A7D7F66FB26F7001C8A2FD7F0F8700
- SPKI SHA-256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
- Validity: 2010-05-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 268920424 (0x10076668)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 10 11:07:04 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Wilhelmshaven, CN = HS-WOE CA - G01, emailAddress = pki@hs-woe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3A:37:3A:64:BA:95:5B:11:E7:85:B4:DB:04:72:DD:FA:84:19:F7:9B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-woe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C791B500A6A0C4E85568EE2E91D8F46B19A7D7F66FB26F7001C8A2FD7F0F8700
    SPKI SHA256: A9343CF3E9F3F16883677A8876809CA1A7A193DAF7A6A0B9AF278D097184BA1C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HS-ZIGR CA

- Subject: countryName=DE, organizationName=Hochschule Zittau/Goerlitz, commonName=HS-ZIGR CA, emailAddress=ca@hs-zigr.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790611228AEF1
- SHA-256: C6E85A3F331EE276A5A7DCB169155CE4666D78041C710A7BD1E062676182C760
- SPKI SHA-256: E9CD96E0289619DF8325CA735EAD33741723F605AAD0881EA36F5A78096BA16E
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671055228657 (0x1790611228aef1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:43 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Zittau/Goerlitz, CN = HS-ZIGR CA, emailAddress = ca@hs-zigr.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:03:86:CF:46:0F:F6:B2:95:2D:19:20:09:4F:89:5E:59:24:A0:47
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-zigr.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C6E85A3F331EE276A5A7DCB169155CE4666D78041C710A7BD1E062676182C760
    SPKI SHA256: E9CD96E0289619DF8325CA735EAD33741723F605AAD0881EA36F5A78096BA16E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HS-ZIGR CA

- Subject: countryName=DE, organizationName=Hochschule Zittau/Goerlitz, commonName=HS-ZIGR CA, emailAddress=ca@hs-zigr.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A3C0D09
- SHA-256: 35E7530D33315A4D73D138A4DAAC1117C749D0C7F423B8D3F80A6B8F4FFAD01B
- SPKI SHA-256: E9CD96E0289619DF8325CA735EAD33741723F605AAD0881EA36F5A78096BA16E
- Validity: 2007-04-11 to 2019-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171707657 (0xa3c0d09)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 07:34:18 2007 GMT
            Not After : Apr  9 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Zittau/Goerlitz, CN = HS-ZIGR CA, emailAddress = ca@hs-zigr.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:03:86:CF:46:0F:F6:B2:95:2D:19:20:09:4F:89:5E:59:24:A0:47
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hs-zigr.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 35E7530D33315A4D73D138A4DAAC1117C749D0C7F423B8D3F80A6B8F4FFAD01B
    SPKI SHA256: E9CD96E0289619DF8325CA735EAD33741723F605AAD0881EA36F5A78096BA16E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSKA-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Hochschule Karlsruhe - Technik und Wirtschaft, commonName=HSKA-CA, emailAddress=iz-ca@hs-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B623478
- SHA-256: 0F5AD191B3B89E565B5D8DB5F43C33A87B927AE180DFB4BBB8739A0F4B3EC5DB
- SPKI SHA-256: 48664879D6836CFF3AEE4CC2712E5A73E893BC7D186A71E8DA8DB59F401ED808
- Validity: 2007-11-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 190985336 (0xb623478)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 20 10:28:58 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Hochschule Karlsruhe - Technik und Wirtschaft, CN = HSKA-CA, emailAddress = iz-ca@hs-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4E:2D:FE:7C:44:5C:A1:DF:E1:8D:D2:37:00:92:40:90:2C:DB:20:7B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:iz-ca@hs-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0F5AD191B3B89E565B5D8DB5F43C33A87B927AE180DFB4BBB8739A0F4B3EC5DB
    SPKI SHA256: 48664879D6836CFF3AEE4CC2712E5A73E893BC7D186A71E8DA8DB59F401ED808
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSKA-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Hochschule Karlsruhe - Technik und Wirtschaft, commonName=HSKA-CA, emailAddress=iz-ca@hs-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424EEE1BE8B
- SHA-256: 0DD2449A69CB34551DD40322877701473C31019EDBEB8E1EB7AD88EDE0F150B9
- SPKI SHA-256: 48664879D6836CFF3AEE4CC2712E5A73E893BC7D186A71E8DA8DB59F401ED808
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402997894795 (0x17a424eee1be8b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Hochschule Karlsruhe - Technik und Wirtschaft, CN = HSKA-CA, emailAddress = iz-ca@hs-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4E:2D:FE:7C:44:5C:A1:DF:E1:8D:D2:37:00:92:40:90:2C:DB:20:7B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:iz-ca@hs-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0DD2449A69CB34551DD40322877701473C31019EDBEB8E1EB7AD88EDE0F150B9
    SPKI SHA256: 48664879D6836CFF3AEE4CC2712E5A73E893BC7D186A71E8DA8DB59F401ED808
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HSRM-CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Hochschule RheinMain, organizationalUnitName=IT-Center, commonName=HSRM-CA, emailAddress=pki-itc@hs-rm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12183491
- SHA-256: FC98388BC61B091EA0394271712F678EC88C683E3A9BE06BCDFF672FA4DA6D19
- SPKI SHA-256: EB48A1FB804EA261E3B7F12BFA147BB73AD316F6227A3ACD15ECCF246D7E5394
- Validity: 2011-06-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 303576209 (0x12183491)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 15 13:43:30 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Wiesbaden, O = Hochschule RheinMain, OU = IT-Center, CN = HSRM-CA, emailAddress = pki-itc@hs-rm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CA:6C:25:FD:80:DC:59:53:B1:78:08:E6:25:D8:D8:3B:D3:16:4D:D9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-itc@hs-rm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FC98388BC61B091EA0394271712F678EC88C683E3A9BE06BCDFF672FA4DA6D19
    SPKI SHA256: EB48A1FB804EA261E3B7F12BFA147BB73AD316F6227A3ACD15ECCF246D7E5394
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSRM-CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Wiesbaden, organizationName=Hochschule RheinMain, organizationalUnitName=IT-Center, commonName=HSRM-CA, emailAddress=pki-itc@hs-rm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF73CF2A35F
- SHA-256: 7DC6782466294EA1913834F885A5A2F25C0857DF65247C239BACCF2DED6A186A
- SPKI SHA-256: EB48A1FB804EA261E3B7F12BFA147BB73AD316F6227A3ACD15ECCF246D7E5394
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400878662495 (0x17aff73cf2a35f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Wiesbaden, O = Hochschule RheinMain, OU = IT-Center, CN = HSRM-CA, emailAddress = pki-itc@hs-rm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CA:6C:25:FD:80:DC:59:53:B1:78:08:E6:25:D8:D8:3B:D3:16:4D:D9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-itc@hs-rm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7DC6782466294EA1913834F885A5A2F25C0857DF65247C239BACCF2DED6A186A
    SPKI SHA256: EB48A1FB804EA261E3B7F12BFA147BB73AD316F6227A3ACD15ECCF246D7E5394
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HSRW CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Kleve, organizationName=Hochschule Rhein-Waal, commonName=HSRW CA, emailAddress=pki@hsrw.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D80D9D39
- SHA-256: 8A7ECEF1D2AFEEEE97D97AB28A8B173FF256F1CE13F6887CFA4558150182BA0C
- SPKI SHA-256: 8DA4F888FB756256BD04B0BDE7313C8912A6F9F7D1F536E70969EE3E8F8CFAC5
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399185931577 (0x17aff6d80d9d39)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Kleve, O = Hochschule Rhein-Waal, CN = HSRW CA, emailAddress = pki@hsrw.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                69:3A:C0:74:E7:E8:13:D1:C8:C4:B4:1E:07:45:33:9B:D8:59:2B:C4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hsrw.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8A7ECEF1D2AFEEEE97D97AB28A8B173FF256F1CE13F6887CFA4558150182BA0C
    SPKI SHA256: 8DA4F888FB756256BD04B0BDE7313C8912A6F9F7D1F536E70969EE3E8F8CFAC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HSRW CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Kleve, organizationName=Hochschule Rhein-Waal, commonName=HSRW CA, emailAddress=pki@hsrw.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FF52303
- SHA-256: BD6B71868266C0489E88BA3C8A0702549EA7F2EBC800EB2842731A28D3F3BD1C
- SPKI SHA-256: 8DA4F888FB756256BD04B0BDE7313C8912A6F9F7D1F536E70969EE3E8F8CFAC5
- Validity: 2010-04-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 267723523 (0xff52303)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 26 14:38:43 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Kleve, O = Hochschule Rhein-Waal, CN = HSRW CA, emailAddress = pki@hsrw.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                69:3A:C0:74:E7:E8:13:D1:C8:C4:B4:1E:07:45:33:9B:D8:59:2B:C4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hsrw.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BD6B71868266C0489E88BA3C8A0702549EA7F2EBC800EB2842731A28D3F3BD1C
    SPKI SHA256: 8DA4F888FB756256BD04B0BDE7313C8912A6F9F7D1F536E70969EE3E8F8CFAC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSU CA - G01

- Subject: countryName=DE, organizationName=Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, commonName=HSU CA - G01, emailAddress=ca@hsu-hh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B5A5FEA
- SHA-256: CD8EC0680451287C5D24EC9558E50A5D9B4854DB87153EC2ED44B12B135BE49A
- SPKI SHA-256: 820279D3DF109AA1F73DD175403030066A54F79322756AE6AEA1045CFD3A8E32
- Validity: 2007-11-14 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 190472170 (0xb5a5fea)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 14 11:56:12 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, CN = HSU CA - G01, emailAddress = ca@hsu-hh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D0:E1:7F:1D:C7:32:BC:E2:90:BB:58:14:80:14:C6:5F:9D:EC:C1:AA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hsu-hh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CD8EC0680451287C5D24EC9558E50A5D9B4854DB87153EC2ED44B12B135BE49A
    SPKI SHA256: 820279D3DF109AA1F73DD175403030066A54F79322756AE6AEA1045CFD3A8E32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSU CA - G01

- Subject: countryName=DE, organizationName=Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, commonName=HSU CA - G01, emailAddress=ca@hsu-hh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42497BCEDEC
- SHA-256: 843EB1C462F927778F56624ED52C3819800F9C4C8062E49D4CFFC5D3AA64C706
- SPKI SHA-256: 820279D3DF109AA1F73DD175403030066A54F79322756AE6AEA1045CFD3A8E32
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401535864300 (0x17a42497bcedec)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:59 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg, CN = HSU CA - G01, emailAddress = ca@hsu-hh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D0:E1:7F:1D:C7:32:BC:E2:90:BB:58:14:80:14:C6:5F:9D:EC:C1:AA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hsu-hh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 843EB1C462F927778F56624ED52C3819800F9C4C8062E49D4CFFC5D3AA64C706
    SPKI SHA256: 820279D3DF109AA1F73DD175403030066A54F79322756AE6AEA1045CFD3A8E32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### hswca - G02

- Subject: countryName=DE, organizationName=Hochschule Wismar, commonName=hswca - G02, emailAddress=pki@hs-wismar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A285C54
- SHA-256: 3C5F559E13ED59FC40413B9FD4731B951C94CDA504B87DAF95D96D89BED085DD
- SPKI SHA-256: 0E025BE82759BA285DA35C8FAACB398827C46EA52E12C8EB330B5CF5DF79E9C9
- Validity: 2007-03-27 to 2019-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170417236 (0xa285c54)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 09:07:17 2007 GMT
            Not After : Mar 26 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule Wismar, CN = hswca - G02, emailAddress = pki@hs-wismar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0C:C6:71:C5:9A:23:4F:18:2E:23:AD:13:5B:EB:CC:8F:C0:B7:5D:BF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-wismar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3C5F559E13ED59FC40413B9FD4731B951C94CDA504B87DAF95D96D89BED085DD
    SPKI SHA256: 0E025BE82759BA285DA35C8FAACB398827C46EA52E12C8EB330B5CF5DF79E9C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### hswca - G02

- Subject: countryName=DE, organizationName=Hochschule Wismar, commonName=hswca - G02, emailAddress=pki@hs-wismar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179061052ACB19
- SHA-256: 4939DCDFC2B8C21FDA9F2B3C2830380AF1FA9E66BAD8B453F3581711D1FF7592
- SPKI SHA-256: 0E025BE82759BA285DA35C8FAACB398827C46EA52E12C8EB330B5CF5DF79E9C9
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670837263129 (0x179061052acb19)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule Wismar, CN = hswca - G02, emailAddress = pki@hs-wismar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0C:C6:71:C5:9A:23:4F:18:2E:23:AD:13:5B:EB:CC:8F:C0:B7:5D:BF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hs-wismar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4939DCDFC2B8C21FDA9F2B3C2830380AF1FA9E66BAD8B453F3581711D1FF7592
    SPKI SHA256: 0E025BE82759BA285DA35C8FAACB398827C46EA52E12C8EB330B5CF5DF79E9C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HSZ-BW CA

- Subject: countryName=DE, organizationName=Hochschulservicezentrum Baden-Wuerttemberg, organizationalUnitName=SNA, commonName=HSZ-BW CA, emailAddress=ca@hsz-bw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FD03BA7
- SHA-256: F45B1DB0711BADF2FABF6A97FDB5AA1AA441A7414DE1AC1CC969DC0AA4466D9E
- SPKI SHA-256: 7493B6520E068AADB4EC6C51B26F6FD5A0831E70CF12A63799203048C5F082D1
- Validity: 2010-03-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 265304999 (0xfd03ba7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 29 14:50:00 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschulservicezentrum Baden-Wuerttemberg, OU = SNA, CN = HSZ-BW CA, emailAddress = ca@hsz-bw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                92:3E:21:4B:65:FF:3E:E3:4D:C7:83:2F:D7:49:27:81:64:BD:A7:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hsz-bw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F45B1DB0711BADF2FABF6A97FDB5AA1AA441A7414DE1AC1CC969DC0AA4466D9E
    SPKI SHA256: 7493B6520E068AADB4EC6C51B26F6FD5A0831E70CF12A63799203048C5F082D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HSZ-BW CA

- Subject: countryName=DE, organizationName=Hochschulservicezentrum Baden-Wuerttemberg, organizationalUnitName=SNA, commonName=HSZ-BW CA, emailAddress=ca@hsz-bw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D5177E1D
- SHA-256: 7570F4F524B5617CDB8847625633E3EFF8BBA8131938D7E8DB3B1C4F17E0C4EA
- SPKI SHA-256: 7493B6520E068AADB4EC6C51B26F6FD5A0831E70CF12A63799203048C5F082D1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399136247325 (0x17aff6d5177e1d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschulservicezentrum Baden-Wuerttemberg, OU = SNA, CN = HSZ-BW CA, emailAddress = ca@hsz-bw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                92:3E:21:4B:65:FF:3E:E3:4D:C7:83:2F:D7:49:27:81:64:BD:A7:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hsz-bw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7570F4F524B5617CDB8847625633E3EFF8BBA8131938D7E8DB3B1C4F17E0C4EA
    SPKI SHA256: 7493B6520E068AADB4EC6C51B26F6FD5A0831E70CF12A63799203048C5F082D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HTW-Dresden CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Dresden (FH), commonName=HTW-Dresden CA - G02, emailAddress=ca@rz.htw-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F10A59
- SHA-256: BC425026D851D84EB338F5E7DC7E15840CE0C32344E2940F0F6067EE33C6B128
- SPKI SHA-256: E5305BAB246C9C26D5089E420573918497814F43DAE1F5416F64F95D5E18CEE4
- Validity: 2007-02-13 to 2019-02-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166791769 (0x9f10a59)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 13 10:02:50 2007 GMT
            Not After : Feb 12 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik und Wirtschaft Dresden (FH), CN = HTW-Dresden CA - G02, emailAddress = ca@rz.htw-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                90:7F:AE:D6:3D:8F:25:C9:B5:B3:01:31:0E:D6:F4:20:5F:3C:CD:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.htw-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BC425026D851D84EB338F5E7DC7E15840CE0C32344E2940F0F6067EE33C6B128
    SPKI SHA256: E5305BAB246C9C26D5089E420573918497814F43DAE1F5416F64F95D5E18CEE4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HTW-Dresden CA - G02

- Subject: countryName=DE, organizationName=Hochschule fuer Technik und Wirtschaft Dresden (FH), commonName=HTW-Dresden CA - G02, emailAddress=ca@rz.htw-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060DE3CAC0D
- SHA-256: 432447982B3554FD9131714D27A420912C7E6C9144794F1AFF01174644D3774C
- SPKI SHA-256: E5305BAB246C9C26D5089E420573918497814F43DAE1F5416F64F95D5E18CEE4
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670184123405 (0x179060de3cac0d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:50 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Technik und Wirtschaft Dresden (FH), CN = HTW-Dresden CA - G02, emailAddress = ca@rz.htw-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                90:7F:AE:D6:3D:8F:25:C9:B5:B3:01:31:0E:D6:F4:20:5F:3C:CD:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.htw-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 432447982B3554FD9131714D27A420912C7E6C9144794F1AFF01174644D3774C
    SPKI SHA256: E5305BAB246C9C26D5089E420573918497814F43DAE1F5416F64F95D5E18CEE4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HTWG KN CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Konstanz, organizationName=Hochschule Konstanz Technik, Wirtschaft und Gestaltung, commonName=HTWG KN CA, emailAddress=pki@htwg-konstanz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E94DE717
- SHA-256: 2AE675D0144C29EAC28EF5429666F1D0E74DEB54EB4D2D0FDA843A39980CF76D
- SPKI SHA-256: 8A37878629E7992136AB0980A5ABC63829FDDDD229B0A031673943CDD6EA453D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399475357463 (0x17aff6e94de717)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:17 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Konstanz, O = "Hochschule Konstanz Technik, Wirtschaft und Gestaltung", CN = HTWG KN CA, emailAddress = pki@htwg-konstanz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:64:33:CD:B3:12:F1:FE:C8:26:B3:FB:66:DF:B8:04:DB:B3:72:DD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htwg-konstanz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2AE675D0144C29EAC28EF5429666F1D0E74DEB54EB4D2D0FDA843A39980CF76D
    SPKI SHA256: 8A37878629E7992136AB0980A5ABC63829FDDDD229B0A031673943CDD6EA453D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HTWG KN CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Konstanz, organizationName=Hochschule Konstanz Technik, Wirtschaft und Gestaltung, commonName=HTWG KN CA, emailAddress=pki@htwg-konstanz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10F790FD
- SHA-256: 86BC6D0A7F327D3FD5962A80A0EA3920009FE7F65DFDDA65049A216B4A76F5A0
- SPKI SHA-256: 8A37878629E7992136AB0980A5ABC63829FDDDD229B0A031673943CDD6EA453D
- Validity: 2010-11-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 284659965 (0x10f790fd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  8 15:12:45 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Konstanz, O = "Hochschule Konstanz Technik, Wirtschaft und Gestaltung", CN = HTWG KN CA, emailAddress = pki@htwg-konstanz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F1:64:33:CD:B3:12:F1:FE:C8:26:B3:FB:66:DF:B8:04:DB:B3:72:DD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htwg-konstanz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 86BC6D0A7F327D3FD5962A80A0EA3920009FE7F65DFDDA65049A216B4A76F5A0
    SPKI SHA256: 8A37878629E7992136AB0980A5ABC63829FDDDD229B0A031673943CDD6EA453D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HTWK Leipzig CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kultur Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424C0DD30B2
- SHA-256: 571B88A23214E1886D15DB49C2F0123631508137941350C2D5C2CEC595B1FF32
- SPKI SHA-256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402225844402 (0x17a424c0dd30b2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = "Hochschule fuer Technik, Wirtschaft und Kultur Leipzig", CN = HTWK Leipzig CA, emailAddress = ca@htwk-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                03:D9:06:94:07:35:54:08:88:85:96:27:33:46:EC:20:8C:DC:CE:55
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@htwk-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 571B88A23214E1886D15DB49C2F0123631508137941350C2D5C2CEC595B1FF32
    SPKI SHA256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HTWK Leipzig CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kunst Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C79A66B
- SHA-256: 5A13B35088F221983601FB7A73C46DD621862CFB196C60F5E0A45ED4083657A5
- SPKI SHA-256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
- Validity: 2008-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 209299051 (0xc79a66b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:37:32 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = "Hochschule fuer Technik, Wirtschaft und Kunst Leipzig", CN = HTWK Leipzig CA, emailAddress = ca@htwk-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                03:D9:06:94:07:35:54:08:88:85:96:27:33:46:EC:20:8C:DC:CE:55
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@htwk-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5A13B35088F221983601FB7A73C46DD621862CFB196C60F5E0A45ED4083657A5
    SPKI SHA256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HTWK Leipzig CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Leipzig, organizationName=Hochschule fuer Technik, Wirtschaft und Kultur Leipzig, commonName=HTWK Leipzig CA, emailAddress=ca@htwk-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C944940
- SHA-256: 578DBE38291A25D36DEBCA7E35F239A51C11829BD124CFE4D5B582C4C064ADFC
- SPKI SHA-256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
- Validity: 2008-07-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 211044672 (0xc944940)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  9 14:31:13 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Leipzig, O = "Hochschule fuer Technik, Wirtschaft und Kultur Leipzig", CN = HTWK Leipzig CA, emailAddress = ca@htwk-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                03:D9:06:94:07:35:54:08:88:85:96:27:33:46:EC:20:8C:DC:CE:55
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@htwk-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 578DBE38291A25D36DEBCA7E35F239A51C11829BD124CFE4D5B582C4C064ADFC
    SPKI SHA256: D31909D2B102AC412EFB6B374C251E2762DD445FA90AAFBD3A5C39114D52A01D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HTWM CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Mittweida, organizationName=Hochschule Mittweida (FH) - University of Applied Sciences, commonName=HTWM CA, emailAddress=pki@htwm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B510882
- SHA-256: 337CD6472561C545FB1670E7C58DD60EDFFFC4036751090A82106C353E563FFF
- SPKI SHA-256: 5A31596668382BB981CD7206EBD3108E7D27EDEEF7EE1143CB12E3B04DFA6B23
- Validity: 2007-11-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 189859970 (0xb510882)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  7 09:52:53 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Mittweida, O = Hochschule Mittweida (FH) - University of Applied Sciences, CN = HTWM CA, emailAddress = pki@htwm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B6:10:D0:71:27:3F:45:B3:76:2E:28:B8:21:BE:40:39:19:EB:79:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htwm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 337CD6472561C545FB1670E7C58DD60EDFFFC4036751090A82106C353E563FFF
    SPKI SHA256: 5A31596668382BB981CD7206EBD3108E7D27EDEEF7EE1143CB12E3B04DFA6B23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HTWM CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Mittweida, organizationName=Hochschule Mittweida (FH) - University of Applied Sciences, commonName=HTWM CA, emailAddress=pki@htwm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42493C85B55
- SHA-256: BEC5F8FF2B20C577BA62A901DA8A808623B0DE7C7EF2ED6057FACBF5C5B9B789
- SPKI SHA-256: 5A31596668382BB981CD7206EBD3108E7D27EDEEF7EE1143CB12E3B04DFA6B23
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401469504341 (0x17a42493c85b55)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:56 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Mittweida, O = Hochschule Mittweida (FH) - University of Applied Sciences, CN = HTWM CA, emailAddress = pki@htwm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B6:10:D0:71:27:3F:45:B3:76:2E:28:B8:21:BE:40:39:19:EB:79:D8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@htwm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BEC5F8FF2B20C577BA62A901DA8A808623B0DE7C7EF2ED6057FACBF5C5B9B789
    SPKI SHA256: 5A31596668382BB981CD7206EBD3108E7D27EDEEF7EE1143CB12E3B04DFA6B23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HU-CA

- Subject: countryName=DE, organizationName=Humboldt-Universitaet zu Berlin, commonName=HU-CA, emailAddress=pki@hu-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424EB3D0CD7
- SHA-256: 61E4CE63F56F5F0AB30836E3C24E40191753EDDCB55DBEF357A4A3C47457C566
- SPKI SHA-256: 41C083C74670681412C74E313492FADE4665912FBB0002C4666B670EABB7F08C
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402936769751 (0x17a424eb3d0cd7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Humboldt-Universitaet zu Berlin, CN = HU-CA, emailAddress = pki@hu-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1F:F5:2C:3E:F7:40:AB:2E:90:A0:6A:D3:E2:79:5E:F2:76:CD:83:74
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hu-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 61E4CE63F56F5F0AB30836E3C24E40191753EDDCB55DBEF357A4A3C47457C566
    SPKI SHA256: 41C083C74670681412C74E313492FADE4665912FBB0002C4666B670EABB7F08C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HU-CA

- Subject: countryName=DE, organizationName=Humboldt-Universitaet zu Berlin, commonName=HU-CA, emailAddress=pki@hu-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B62348F
- SHA-256: 9E48CBFF7E9F327B1CE544761C8B6C4C3121718B06DF0CC3DB088FE60265C8E7
- SPKI SHA-256: 41C083C74670681412C74E313492FADE4665912FBB0002C4666B670EABB7F08C
- Validity: 2007-11-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 190985359 (0xb62348f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 20 10:29:21 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Humboldt-Universitaet zu Berlin, CN = HU-CA, emailAddress = pki@hu-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1F:F5:2C:3E:F7:40:AB:2E:90:A0:6A:D3:E2:79:5E:F2:76:CD:83:74
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hu-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9E48CBFF7E9F327B1CE544761C8B6C4C3121718B06DF0CC3DB088FE60265C8E7
    SPKI SHA256: 41C083C74670681412C74E313492FADE4665912FBB0002C4666B670EABB7F08C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HWR Berlin CA

- Subject: countryName=DE, organizationName=Hochschule fuer Wirtschaft und Recht Berlin, commonName=HWR Berlin CA, emailAddress=pki@hwr-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A79CC893
- SHA-256: C8F7E9D9C7E340FC0CE579AE8A416B5DAF7C6EB71B045E79233232EA3A42C0F6
- SPKI SHA-256: 3AC9E080A4D5178D6559AF4673CF8BB8050C0D197155F7334428DA71887504C1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398373230739 (0x17aff6a79cc893)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Wirtschaft und Recht Berlin, CN = HWR Berlin CA, emailAddress = pki@hwr-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1A:96:13:B0:EA:56:23:64:D8:BE:22:6D:45:B8:0C:98:04:8A:43:69
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hwr-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8F7E9D9C7E340FC0CE579AE8A416B5DAF7C6EB71B045E79233232EA3A42C0F6
    SPKI SHA256: 3AC9E080A4D5178D6559AF4673CF8BB8050C0D197155F7334428DA71887504C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HWR Berlin CA

- Subject: countryName=DE, organizationName=Hochschule fuer Wirtschaft und Recht Berlin, commonName=HWR Berlin CA, emailAddress=pki@hwr-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DD9DAA1
- SHA-256: F138F288719CADDCFE3ABD606C5375531D76FB7ED4E14FE414C12BCDD7E091CF
- SPKI SHA-256: 3AC9E080A4D5178D6559AF4673CF8BB8050C0D197155F7334428DA71887504C1
- Validity: 2009-03-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 232381089 (0xdd9daa1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 13 13:18:10 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Hochschule fuer Wirtschaft und Recht Berlin, CN = HWR Berlin CA, emailAddress = pki@hwr-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1A:96:13:B0:EA:56:23:64:D8:BE:22:6D:45:B8:0C:98:04:8A:43:69
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@hwr-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F138F288719CADDCFE3ABD606C5375531D76FB7ED4E14FE414C12BCDD7E091CF
    SPKI SHA256: 3AC9E080A4D5178D6559AF4673CF8BB8050C0D197155F7334428DA71887504C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HZB CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, commonName=HZB CA, emailAddress=hzbca@helmholtz-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E682896
- SHA-256: BC342930E68430AC6CC6CE23D875D7C7B2D7E9FD3F322E1F92C21A1E0B113CC6
- SPKI SHA-256: E32AA852CE89128881A07A46AADF0F2E1D6CC6BAD03A80C0EC8B376200B48F8E
- Validity: 2009-06-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 241707158 (0xe682896)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 29 11:52:39 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, CN = HZB CA, emailAddress = hzbca@helmholtz-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5E:42:2C:B7:51:36:03:8A:C4:08:9C:81:94:BD:BE:DB:E3:4B:7C:DC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hzbca@helmholtz-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BC342930E68430AC6CC6CE23D875D7C7B2D7E9FD3F322E1F92C21A1E0B113CC6
    SPKI SHA256: E32AA852CE89128881A07A46AADF0F2E1D6CC6BAD03A80C0EC8B376200B48F8E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HZB CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, commonName=HZB CA, emailAddress=hzbca@helmholtz-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B7088AD9
- SHA-256: AF5EA764C3C28A6E20353E4D59EEE56BDA36FCF09F45B2AD87B8AE334E8C34A6
- SPKI SHA-256: E32AA852CE89128881A07A46AADF0F2E1D6CC6BAD03A80C0EC8B376200B48F8E
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398631951065 (0x17aff6b7088ad9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:27 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH, CN = HZB CA, emailAddress = hzbca@helmholtz-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5E:42:2C:B7:51:36:03:8A:C4:08:9C:81:94:BD:BE:DB:E3:4B:7C:DC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:hzbca@helmholtz-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AF5EA764C3C28A6E20353E4D59EEE56BDA36FCF09F45B2AD87B8AE334E8C34A6
    SPKI SHA256: E32AA852CE89128881A07A46AADF0F2E1D6CC6BAD03A80C0EC8B376200B48F8E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### HZG CA

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Geesthacht, organizationName=Helmholtz-Zentrum Geesthacht GmbH, commonName=HZG CA, emailAddress=ca@hzg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10BC2BF8
- SHA-256: 771694FA23BD3F12753B2965F64D37ADFC3C606C3A3A1139A5ADEB849E9F068D
- SPKI SHA-256: 1776F25059425A6AA6B32BCB2078F7C553E2E185F3BC37C67D60D065522FADF9
- Validity: 2010-09-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 280767480 (0x10bc2bf8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 24 13:58:01 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Geesthacht, O = Helmholtz-Zentrum Geesthacht GmbH, CN = HZG CA, emailAddress = ca@hzg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3B:DE:F7:A6:48:CD:37:81:87:3A:D0:9D:28:2D:58:AC:50:16:1B:63
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hzg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 771694FA23BD3F12753B2965F64D37ADFC3C606C3A3A1139A5ADEB849E9F068D
    SPKI SHA256: 1776F25059425A6AA6B32BCB2078F7C553E2E185F3BC37C67D60D065522FADF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### HZG CA

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Geesthacht, organizationName=Helmholtz-Zentrum Geesthacht GmbH, commonName=HZG CA, emailAddress=ca@hzg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E5571751
- SHA-256: 4B5898EA2D471A3988C2591999D60E2E7ED5CD434C92771A459253FA57958DF0
- SPKI SHA-256: 1776F25059425A6AA6B32BCB2078F7C553E2E185F3BC37C67D60D065522FADF9
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399408850769 (0x17aff6e5571751)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:13 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Geesthacht, O = Helmholtz-Zentrum Geesthacht GmbH, CN = HZG CA, emailAddress = ca@hzg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3B:DE:F7:A6:48:CD:37:81:87:3A:D0:9D:28:2D:58:AC:50:16:1B:63
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hzg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4B5898EA2D471A3988C2591999D60E2E7ED5CD434C92771A459253FA57958DF0
    SPKI SHA256: 1776F25059425A6AA6B32BCB2078F7C553E2E185F3BC37C67D60D065522FADF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IAP CA - G01

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Kuehlungsborn, organizationName=Leibniz-Institut fuer Atmosphaerenphysik, organizationalUnitName=Rechenzentrum, commonName=IAP CA - G01, emailAddress=ca@iap-kborn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906101C87D8B
- SHA-256: BF6C7831F44D0016B3CEDAABB3835B14CCF6F24EB477090475783B3A24FB1FA1
- SPKI SHA-256: 3D3DBD1E896D69411E87F76A7E48C9D585BA8928AE4F0395B0FAE042B6EE1ECE
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670780489099 (0x17906101c87d8b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:25 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Kuehlungsborn, O = Leibniz-Institut fuer Atmosphaerenphysik, OU = Rechenzentrum, CN = IAP CA - G01, emailAddress = ca@iap-kborn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                06:7C:1F:D5:B6:1F:F5:4E:33:50:E7:22:10:9B:EF:2F:96:D3:36:62
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@iap-kborn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF6C7831F44D0016B3CEDAABB3835B14CCF6F24EB477090475783B3A24FB1FA1
    SPKI SHA256: 3D3DBD1E896D69411E87F76A7E48C9D585BA8928AE4F0395B0FAE042B6EE1ECE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IAP CA - G01

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Kuehlungsborn, organizationName=Leibniz-Institut fuer Atmosphaerenphysik, organizationalUnitName=Rechenzentrum, commonName=IAP CA - G01, emailAddress=ca@iap-kborn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A1F4682
- SHA-256: 4A720BC00F4D459521DC2168834AE87E58915AEAA07951F6ADB3C707BEEF8BD3
- SPKI SHA-256: 3D3DBD1E896D69411E87F76A7E48C9D585BA8928AE4F0395B0FAE042B6EE1ECE
- Validity: 2007-03-20 to 2019-03-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169821826 (0xa1f4682)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 20 11:43:48 2007 GMT
            Not After : Mar 19 00:00:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Kuehlungsborn, O = Leibniz-Institut fuer Atmosphaerenphysik, OU = Rechenzentrum, CN = IAP CA - G01, emailAddress = ca@iap-kborn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                06:7C:1F:D5:B6:1F:F5:4E:33:50:E7:22:10:9B:EF:2F:96:D3:36:62
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@iap-kborn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4A720BC00F4D459521DC2168834AE87E58915AEAA07951F6ADB3C707BEEF8BD3
    SPKI SHA256: 3D3DBD1E896D69411E87F76A7E48C9D585BA8928AE4F0395B0FAE042B6EE1ECE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IASS Potsdam CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Institute for Advanced Sustainability Studies e.V., organizationalUnitName=IT-Management, commonName=IASS Potsdam CA, emailAddress=ca@iass-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FF5991E9
- SHA-256: D38600BD38B8A4D663458F1FAA4C0B5EA53566480890C293852A10E45ED78B64
- SPKI SHA-256: EDDBD9B6381A96B8C8A9182359CA8FDA3664158CE25042E037A626B718D57D35
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399845220841 (0x17aff6ff5991e9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Potsdam, O = Institute for Advanced Sustainability Studies e.V., OU = IT-Management, CN = IASS Potsdam CA, emailAddress = ca@iass-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FE:EB:42:0E:34:82:BE:C7:B3:DA:31:8B:0C:65:C4:C7:38:E9:69:3D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@iass-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D38600BD38B8A4D663458F1FAA4C0B5EA53566480890C293852A10E45ED78B64
    SPKI SHA256: EDDBD9B6381A96B8C8A9182359CA8FDA3664158CE25042E037A626B718D57D35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IASS Potsdam CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Institute for Advanced Sustainability Studies e.V., organizationalUnitName=IT-Management, commonName=IASS Potsdam CA, emailAddress=ca@iass-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 136F03B4172A61
- SHA-256: 4A2650950F3A7B455BFD39B9C0F26F9376BC96EF351FDFA6C2322BD5E62C36E7
- SPKI SHA-256: EDDBD9B6381A96B8C8A9182359CA8FDA3664158CE25042E037A626B718D57D35
- Validity: 2012-03-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5470086254504545 (0x136f03b4172a61)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  1 14:22:28 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Potsdam, O = Institute for Advanced Sustainability Studies e.V., OU = IT-Management, CN = IASS Potsdam CA, emailAddress = ca@iass-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FE:EB:42:0E:34:82:BE:C7:B3:DA:31:8B:0C:65:C4:C7:38:E9:69:3D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@iass-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4A2650950F3A7B455BFD39B9C0F26F9376BC96EF351FDFA6C2322BD5E62C36E7
    SPKI SHA256: EDDBD9B6381A96B8C8A9182359CA8FDA3664158CE25042E037A626B718D57D35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IDS-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Institut fuer Deutsche Sprache, commonName=IDS-CA - G01, emailAddress=ca@ids-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15C57736DB842F
- SHA-256: 550FDA43EBE776F8B91C2D91EADE7A83927F8D025C99A5E5B6DD0C156A20C179
- SPKI SHA-256: F62FE5FB91875E4F23EBC40F214D5EC95E1B282C976E0DEF21DB843C3C11970D
- Validity: 2013-05-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6128090323059759 (0x15c57736db842f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 29 12:50:46 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Institut fuer Deutsche Sprache, CN = IDS-CA - G01, emailAddress = ca@ids-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                56:BA:96:85:9D:B1:84:A8:73:91:E1:F6:39:9F:A1:86:30:44:0E:CE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ids-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 550FDA43EBE776F8B91C2D91EADE7A83927F8D025C99A5E5B6DD0C156A20C179
    SPKI SHA256: F62FE5FB91875E4F23EBC40F214D5EC95E1B282C976E0DEF21DB843C3C11970D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IDS-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Institut fuer Deutsche Sprache, commonName=IDS-CA - G01, emailAddress=ca@ids-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7156B1EB3
- SHA-256: DE0F9A8FA5B4EE7E29EBBEAEFDD664E1F851C1BEF4C57B264386A33C825355D2
- SPKI SHA-256: F62FE5FB91875E4F23EBC40F214D5EC95E1B282C976E0DEF21DB843C3C11970D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400215469747 (0x17aff7156b1eb3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Institut fuer Deutsche Sprache, CN = IDS-CA - G01, emailAddress = ca@ids-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                56:BA:96:85:9D:B1:84:A8:73:91:E1:F6:39:9F:A1:86:30:44:0E:CE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ids-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE0F9A8FA5B4EE7E29EBBEAEFDD664E1F851C1BEF4C57B264386A33C825355D2
    SPKI SHA256: F62FE5FB91875E4F23EBC40F214D5EC95E1B282C976E0DEF21DB843C3C11970D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IFM-GEOMAR CA - G02

- Subject: countryName=DE, organizationName=IFM-GEOMAR, organizationalUnitName=Rechenzentrum, commonName=IFM-GEOMAR CA - G02, emailAddress=pki@ifm-geomar.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A022355
- SHA-256: E7653E0D3399E6F59DDBD43A64C88D3B0B38EA66662D2BA1ED0200F8E80A7560
- SPKI SHA-256: 86C4C603434FC90F2467C70B0100C67BD9CD42E3F3B53148339F9E0254CBEEF9
- Validity: 2007-02-26 to 2019-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167912277 (0xa022355)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 09:17:58 2007 GMT
            Not After : Feb 25 00:00:00 2019 GMT
        Subject: C = DE, O = IFM-GEOMAR, OU = Rechenzentrum, CN = IFM-GEOMAR CA - G02, emailAddress = pki@ifm-geomar.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                55:DE:22:86:D2:18:60:DE:1C:6B:8C:7D:92:15:F3:59:4B:98:44:CB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifm-geomar.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E7653E0D3399E6F59DDBD43A64C88D3B0B38EA66662D2BA1ED0200F8E80A7560
    SPKI SHA256: 86C4C603434FC90F2467C70B0100C67BD9CD42E3F3B53148339F9E0254CBEEF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ifn-magdeburg CA-G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Neurobiologie Magdeburg, commonName=ifn-magdeburg CA-G01, emailAddress=pki@ifn-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B632B856
- SHA-256: AE858985451B21137F5F73697A09AB814D5EA24B1A674EE9953F276550863F7C
- SPKI SHA-256: BF5B25005497C8032CB050D47264E84F472533BCF737B4C273FA5B10469A6783
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398617938006 (0x17aff6b632b856)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Neurobiologie Magdeburg, CN = ifn-magdeburg CA-G01, emailAddress = pki@ifn-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                81:0D:A1:7B:F5:AE:0C:DC:E4:01:5D:D6:71:3B:28:40:F1:11:DD:23
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifn-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AE858985451B21137F5F73697A09AB814D5EA24B1A674EE9953F276550863F7C
    SPKI SHA256: BF5B25005497C8032CB050D47264E84F472533BCF737B4C273FA5B10469A6783
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ifn-magdeburg CA-G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Neurobiologie Magdeburg, commonName=ifn-magdeburg CA-G01, emailAddress=pki@ifn-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E68288F
- SHA-256: EB4C9C243E0277615F01773194450B9F1649F8104CD3089299538E54DAFF4E30
- SPKI SHA-256: BF5B25005497C8032CB050D47264E84F472533BCF737B4C273FA5B10469A6783
- Validity: 2009-06-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 241707151 (0xe68288f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 29 11:52:31 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Neurobiologie Magdeburg, CN = ifn-magdeburg CA-G01, emailAddress = pki@ifn-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                81:0D:A1:7B:F5:AE:0C:DC:E4:01:5D:D6:71:3B:28:40:F1:11:DD:23
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifn-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EB4C9C243E0277615F01773194450B9F1649F8104CD3089299538E54DAFF4E30
    SPKI SHA256: BF5B25005497C8032CB050D47264E84F472533BCF737B4C273FA5B10469A6783
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IFW Dresden CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=IFW Dresden e.V., commonName=IFW Dresden CA, emailAddress=ca@ifw-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C140E0C
- SHA-256: BC957667A4718A3A3598316866C0A81735EE41ABF68E94EA39C59DA7F1B8F4F1
- SPKI SHA-256: B0FB19271554CC3CA23D65F55B639AE0C3B681031B4283165D0BC61EA731587A
- Validity: 2008-04-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 202640908 (0xc140e0c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 08:08:30 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = IFW Dresden e.V., CN = IFW Dresden CA, emailAddress = ca@ifw-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2E:F3:0B:1D:16:C3:EC:B7:4E:F5:92:25:1E:C0:8F:40:42:71:87:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ifw-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BC957667A4718A3A3598316866C0A81735EE41ABF68E94EA39C59DA7F1B8F4F1
    SPKI SHA256: B0FB19271554CC3CA23D65F55B639AE0C3B681031B4283165D0BC61EA731587A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IFW Dresden CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=IFW Dresden e.V., commonName=IFW Dresden CA, emailAddress=ca@ifw-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B4A253B4
- SHA-256: 4846A0241C46E378E2AD5561B9C3B1615B4643D5CB7AF5541CC751A971967126
- SPKI SHA-256: B0FB19271554CC3CA23D65F55B639AE0C3B681031B4283165D0BC61EA731587A
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402020660148 (0x17a424b4a253b4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:28 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = IFW Dresden e.V., CN = IFW Dresden CA, emailAddress = ca@ifw-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:F3:0B:1D:16:C3:EC:B7:4E:F5:92:25:1E:C0:8F:40:42:71:87:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ifw-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4846A0241C46E378E2AD5561B9C3B1615B4643D5CB7AF5541CC751A971967126
    SPKI SHA256: B0FB19271554CC3CA23D65F55B639AE0C3B681031B4283165D0BC61EA731587A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHP-CA

- Subject: countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki.ca@ihp-microelectronics.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B2B0813
- SHA-256: CBA12A1C576478F58619A154FCAA18B7B49FA15359F26552F850FEAE531570CF
- SPKI SHA-256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
- Validity: 2007-10-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 187369491 (0xb2b0813)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  9 14:04:53 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = IHP GmbH, CN = IHP-CA, emailAddress = pki.ca@ihp-microelectronics.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2C:2A:F7:1A:E0:C9:28:A4:AC:68:0D:BB:13:84:BE:86:CC:DC:F0:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki.ca@ihp-microelectronics.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CBA12A1C576478F58619A154FCAA18B7B49FA15359F26552F850FEAE531570CF
    SPKI SHA256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IHP-CA

- Subject: countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki@ihp-microelectronics.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42507FC97F8
- SHA-256: 3CF6730D73A31ACCAB191DCF9CAB29A79C75BCD0837C73B61655A8FDEC88753E
- SPKI SHA-256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403419084792 (0x17a42507fc97f8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = IHP GmbH, CN = IHP-CA, emailAddress = pki@ihp-microelectronics.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2C:2A:F7:1A:E0:C9:28:A4:AC:68:0D:BB:13:84:BE:86:CC:DC:F0:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki.ca@ihp-microelectronics.com, email:pki@ihp-microelectronics.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3CF6730D73A31ACCAB191DCF9CAB29A79C75BCD0837C73B61655A8FDEC88753E
    SPKI SHA256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHP-CA

- Subject: countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki.ca@ihp-microelectronics.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181E901F66607A
- SHA-256: ADC39F065BB2D20221C8D47CF73D980C8B884A25EC1A55FEF35383F7282B7B19
- SPKI SHA-256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
- Validity: 2014-08-28 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6789003791982714 (0x181e901f66607a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 28 11:29:19 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, O = IHP GmbH, CN = IHP-CA, emailAddress = pki.ca@ihp-microelectronics.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                2C:2A:F7:1A:E0:C9:28:A4:AC:68:0D:BB:13:84:BE:86:CC:DC:F0:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki.ca@ihp-microelectronics.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ADC39F065BB2D20221C8D47CF73D980C8B884A25EC1A55FEF35383F7282B7B19
    SPKI SHA256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHP-CA

- Subject: countryName=DE, organizationName=IHP GmbH, commonName=IHP-CA, emailAddress=pki@ihp-microelectronics.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B2AF53C
- SHA-256: 4184207B01F085D29786DB191D4B090FA511CB95AA9B8A0A25F07826002A55D4
- SPKI SHA-256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
- Validity: 2007-10-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 187364668 (0xb2af53c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  9 12:44:30 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = IHP GmbH, CN = IHP-CA, emailAddress = pki@ihp-microelectronics.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2C:2A:F7:1A:E0:C9:28:A4:AC:68:0D:BB:13:84:BE:86:CC:DC:F0:BE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ihp-microelectronics.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4184207B01F085D29786DB191D4B090FA511CB95AA9B8A0A25F07826002A55D4
    SPKI SHA256: 48E450FA207996CF58694051F7CCA4442E073BC99A8CBF3ACA1809388D4BA0F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ILK Dresden CA - G01

- Subject: countryName=DE, organizationName=Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, commonName=ILK Dresden CA - G01, emailAddress=ca@ilkdresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7098B1BC0
- SHA-256: E6650D4D46C492D59B27F25E0A58056815F4A3E708391EB16E7A843124638836
- SPKI SHA-256: 81E777D36D018928FA72BFE0D384B897742E7E0AA2C00E76FF992EC2ABE2219B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400016239552 (0x17aff7098b1bc0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:50 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, CN = ILK Dresden CA - G01, emailAddress = ca@ilkdresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F4:3B:2E:1A:08:C0:1A:93:DB:73:ED:CA:8C:A9:D4:D9:6E:ED:13:3F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ilkdresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E6650D4D46C492D59B27F25E0A58056815F4A3E708391EB16E7A843124638836
    SPKI SHA256: 81E777D36D018928FA72BFE0D384B897742E7E0AA2C00E76FF992EC2ABE2219B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ILK Dresden CA - G01

- Subject: countryName=DE, organizationName=Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, commonName=ILK Dresden CA - G01, emailAddress=ca@ilkdresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1479280CFA4ADB
- SHA-256: 47D6C394279D05C94DF72BDD3A8BBEBCFF9D6E3C9DF21E0B972DBE8D8E807219
- SPKI SHA-256: 81E777D36D018928FA72BFE0D384B897742E7E0AA2C00E76FF992EC2ABE2219B
- Validity: 2012-09-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5762712457595611 (0x1479280cfa4adb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 19 11:20:28 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Institut fuer Luft- und Kaeltetechnik gemeinnuetzige GmbH, CN = ILK Dresden CA - G01, emailAddress = ca@ilkdresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F4:3B:2E:1A:08:C0:1A:93:DB:73:ED:CA:8C:A9:D4:D9:6E:ED:13:3F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ilkdresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 47D6C394279D05C94DF72BDD3A8BBEBCFF9D6E3C9DF21E0B972DBE8D8E807219
    SPKI SHA256: 81E777D36D018928FA72BFE0D384B897742E7E0AA2C00E76FF992EC2ABE2219B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### INP-Greifswald CA

- Subject: countryName=DE, localityName=Greifswald, organizationName=Leibniz-Institut fuer Plasmaforschung und Technologie e.V., commonName=INP-Greifswald CA, emailAddress=ca@inp-greifswald.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B735262
- SHA-256: 1BB8B5A9FDB2DF3841C8E7E3BAA02026D3ADF29C26FD3735B64A1F85811A674F
- SPKI SHA-256: E930F4E850CD2ADB76CBE342E78984E7557348A0918E4E563AEDE3E3662F5E31
- Validity: 2007-12-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 192107106 (0xb735262)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  3 10:05:07 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Greifswald, O = Leibniz-Institut fuer Plasmaforschung und Technologie e.V., CN = INP-Greifswald CA, emailAddress = ca@inp-greifswald.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FA:AA:D5:0D:08:45:F5:44:15:5F:23:B3:3B:2B:C9:38:81:0E:50:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@inp-greifswald.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1BB8B5A9FDB2DF3841C8E7E3BAA02026D3ADF29C26FD3735B64A1F85811A674F
    SPKI SHA256: E930F4E850CD2ADB76CBE342E78984E7557348A0918E4E563AEDE3E3662F5E31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### INP-Greifswald CA

- Subject: countryName=DE, localityName=Greifswald, organizationName=Leibniz-Institut fuer Plasmaforschung und Technologie e.V., commonName=INP-Greifswald CA, emailAddress=ca@inp-greifswald.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4249AAA55BF
- SHA-256: AABFD2BA6B6ECB08B64B40D0D71BE42E4D29808CA994876810095AD3652CB634
- SPKI SHA-256: E930F4E850CD2ADB76CBE342E78984E7557348A0918E4E563AEDE3E3662F5E31
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401584977343 (0x17a4249aaa55bf)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Greifswald, O = Leibniz-Institut fuer Plasmaforschung und Technologie e.V., CN = INP-Greifswald CA, emailAddress = ca@inp-greifswald.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FA:AA:D5:0D:08:45:F5:44:15:5F:23:B3:3B:2B:C9:38:81:0E:50:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@inp-greifswald.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AABFD2BA6B6ECB08B64B40D0D71BE42E4D29808CA994876810095AD3652CB634
    SPKI SHA256: E930F4E850CD2ADB76CBE342E78984E7557348A0918E4E563AEDE3E3662F5E31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01

- Subject: countryName=DE, organizationName=Institut fuer Weltwirtschaft an der Universitaet Kiel, organizationalUnitName=IT-Strukturen, commonName=Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress=pki@ifw-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FD07E739
- SHA-256: 1ECE3B29D798C360F3D4758916B282C7459D4E55F1770A7A6542F1156BB557D3
- SPKI SHA-256: 705AAFE9817767ABBACF35E0B44B2071F8C4BE0C01DDDF8A81AA9A8C71EC7BE9
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399806314297 (0x17aff6fd07e739)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:37 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Institut fuer Weltwirtschaft an der Universitaet Kiel, OU = IT-Strukturen, CN = Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress = pki@ifw-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                13:CF:5F:15:F1:A9:81:41:91:C9:29:D8:99:8A:16:D8:DA:EB:41:5D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifw-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1ECE3B29D798C360F3D4758916B282C7459D4E55F1770A7A6542F1156BB557D3
    SPKI SHA256: 705AAFE9817767ABBACF35E0B44B2071F8C4BE0C01DDDF8A81AA9A8C71EC7BE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01

- Subject: countryName=DE, organizationName=Institut fuer Weltwirtschaft an der Universitaet Kiel, organizationalUnitName=IT-Strukturen, commonName=Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress=pki@ifw-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12FC3F806E2EAC
- SHA-256: F290D885A139C44E0656C0A56BF02EF70FEBD2C74E2E7BD285A41E99DECC83FD
- SPKI SHA-256: 705AAFE9817767ABBACF35E0B44B2071F8C4BE0C01DDDF8A81AA9A8C71EC7BE9
- Validity: 2011-12-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5343899248635564 (0x12fc3f806e2eac)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  5 13:06:56 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Institut fuer Weltwirtschaft an der Universitaet Kiel, OU = IT-Strukturen, CN = Institut fuer Weltwirtschaft an der Universitaet Kiel CA - G01, emailAddress = pki@ifw-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                13:CF:5F:15:F1:A9:81:41:91:C9:29:D8:99:8A:16:D8:DA:EB:41:5D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifw-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F290D885A139C44E0656C0A56BF02EF70FEBD2C74E2E7BD285A41E99DECC83FD
    SPKI SHA256: 705AAFE9817767ABBACF35E0B44B2071F8C4BE0C01DDDF8A81AA9A8C71EC7BE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Institute of Shipping Economics and Logistics (ISL) - CA

- Subject: countryName=DE, organizationName=Institut fuer Seeverkehrswirtschaft und Logistik (ISL), commonName=Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress=pki@isl.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 11F9EBD8
- SHA-256: ED558CBE1E69036004119F01E5DC887F48AA31E3CDA61870A515999DF0B4E17C
- SPKI SHA-256: 6D676549DE3B0792AF555500636A1EAF5CDE1ABAE1903E2815C9A68749210CAA
- Validity: 2011-05-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 301591512 (0x11f9ebd8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 23 14:25:13 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Institut fuer Seeverkehrswirtschaft und Logistik (ISL), CN = Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress = pki@isl.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0B:2B:6F:EE:A8:88:AB:02:5A:84:6C:55:BD:07:69:FF:0E:8E:45:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@isl.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: ED558CBE1E69036004119F01E5DC887F48AA31E3CDA61870A515999DF0B4E17C
    SPKI SHA256: 6D676549DE3B0792AF555500636A1EAF5CDE1ABAE1903E2815C9A68749210CAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Institute of Shipping Economics and Logistics (ISL) - CA

- Subject: countryName=DE, organizationName=Institut fuer Seeverkehrswirtschaft und Logistik (ISL), commonName=Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress=pki@isl.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F420FEEC
- SHA-256: C4D02D0AC70E0FD768CA59F056487AEA6E60BB66AAC6621E4449F774804021DF
- SPKI SHA-256: 6D676549DE3B0792AF555500636A1EAF5CDE1ABAE1903E2815C9A68749210CAA
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399656963820 (0x17aff6f420feec)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:28 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Institut fuer Seeverkehrswirtschaft und Logistik (ISL), CN = Institute of Shipping Economics and Logistics (ISL) - CA, emailAddress = pki@isl.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0B:2B:6F:EE:A8:88:AB:02:5A:84:6C:55:BD:07:69:FF:0E:8E:45:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@isl.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C4D02D0AC70E0FD768CA59F056487AEA6E60BB66AAC6621E4449F774804021DF
    SPKI SHA256: 6D676549DE3B0792AF555500636A1EAF5CDE1ABAE1903E2815C9A68749210CAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IPF CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E0EA740
- SHA-256: 77A7AA4D54420BCC1D49BBBDB4226C37FC2D23A04F932664786E9EF21F058DC2
- SPKI SHA-256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
- Validity: 2007-04-11 to 2019-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 235841344 (0xe0ea740)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 09:33:00 2007 GMT
            Not After : Apr  9 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Leibniz-Institut fuer Polymerforschung Dresden e.V., CN = IPF CA - G01, emailAddress = pki@ipfdd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AC:47:1D:17:03:37:A5:C1:58:40:9D:6D:32:D9:3E:A2:08:7E:3C:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ipfdd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 77A7AA4D54420BCC1D49BBBDB4226C37FC2D23A04F932664786E9EF21F058DC2
    SPKI SHA256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IPF CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6ADD59288
- SHA-256: 3AFFAC819FCA8D1BB0E0388A5A72324F1619698CE69886C4EF76658EBAAF7EA6
- SPKI SHA-256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
- Validity: 2007-04-11 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398477615752 (0x17aff6add59288)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 09:33:00 2007 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Leibniz-Institut fuer Polymerforschung Dresden e.V., CN = IPF CA - G01, emailAddress = pki@ipfdd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AC:47:1D:17:03:37:A5:C1:58:40:9D:6D:32:D9:3E:A2:08:7E:3C:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ipfdd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3AFFAC819FCA8D1BB0E0388A5A72324F1619698CE69886C4EF76658EBAAF7EA6
    SPKI SHA256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IPF CA - G01

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Leibniz-Institut fuer Polymerforschung Dresden e.V., commonName=IPF CA - G01, emailAddress=pki@ipfdd.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A3C0CEE
- SHA-256: EC4C5BF99B3A5392267F23DB61505D3F94D808D6E0A11457029E821E90583AC6
- SPKI SHA-256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
- Validity: 2007-04-11 to 2019-04-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171707630 (0xa3c0cee)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 11 07:33:52 2007 GMT
            Not After : Apr  9 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Leibniz-Institut fuer Polymerforschung Dresden e.V., CN = IPF CA - G01, emailAddress = pki@ipfdd.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AC:47:1D:17:03:37:A5:C1:58:40:9D:6D:32:D9:3E:A2:08:7E:3C:72
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ipfdd.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EC4C5BF99B3A5392267F23DB61505D3F94D808D6E0A11457029E821E90583AC6
    SPKI SHA256: 06EAD23A4F0CF4FCDD41393DBA83DD401E060DDC868D6506DCACC2FBD8156012
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IPHT-JENA-CA

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Institut fuer Photonische Technologien e.V., organizationalUnitName=EDV/IPHT, commonName=IPHT-JENA-CA, emailAddress=ipht-cert@ipht-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A6A4F4F
- SHA-256: 1ADFF3E2F55845B074E1F14798487B1C6F1441B8B7D9621391F6580801FCC126
- SPKI SHA-256: FCE1AD4C02BD9A56962294FAC6ED047610071B7DE2A5D96D6CFBC5F667F0D089
- Validity: 2007-05-16 to 2019-05-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 174739279 (0xa6a4f4f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 16 09:41:21 2007 GMT
            Not After : May 15 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Institut fuer Photonische Technologien e.V., OU = EDV/IPHT, CN = IPHT-JENA-CA, emailAddress = ipht-cert@ipht-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                97:32:B2:02:14:56:5F:46:A8:74:DE:EB:6C:82:BB:8E:35:96:D2:AC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ipht-cert@ipht-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1ADFF3E2F55845B074E1F14798487B1C6F1441B8B7D9621391F6580801FCC126
    SPKI SHA256: FCE1AD4C02BD9A56962294FAC6ED047610071B7DE2A5D96D6CFBC5F667F0D089
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IPHT-JENA-CA

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Institut fuer Photonische Technologien e.V., organizationalUnitName=EDV/IPHT, commonName=IPHT-JENA-CA, emailAddress=ipht-cert@ipht-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42558AAAD2B
- SHA-256: E3ED8713A3F05230EFCD99761EB63ED4E3DB850C9FB95F2B0F18EFF75A341CDC
- SPKI SHA-256: FCE1AD4C02BD9A56962294FAC6ED047610071B7DE2A5D96D6CFBC5F667F0D089
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404772670763 (0x17a42558aaad2b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:12 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Institut fuer Photonische Technologien e.V., OU = EDV/IPHT, CN = IPHT-JENA-CA, emailAddress = ipht-cert@ipht-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                97:32:B2:02:14:56:5F:46:A8:74:DE:EB:6C:82:BB:8E:35:96:D2:AC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ipht-cert@ipht-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E3ED8713A3F05230EFCD99761EB63ED4E3DB850C9FB95F2B0F18EFF75A341CDC
    SPKI SHA256: FCE1AD4C02BD9A56962294FAC6ED047610071B7DE2A5D96D6CFBC5F667F0D089
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IPK Gatersleben CA - G02

- Subject: countryName=DE, organizationName=IPK Gatersleben, commonName=IPK Gatersleben CA - G02, emailAddress=ca@ipk-gatersleben.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF698269567
- SHA-256: 84337F2DFF2E2A506607BFC102FC092EA37656D0FE5DFA1E4EADA0D3BD0FB130
- SPKI SHA-256: 6E37ACF9BA2FEF1C61D3C1B4A48CAD60811779D50BB333199AA539C81FD36166
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398113826151 (0x17aff698269567)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:56 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = IPK Gatersleben, CN = IPK Gatersleben CA - G02, emailAddress = ca@ipk-gatersleben.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                53:97:75:E7:4C:FB:B9:5C:6C:18:47:23:F5:AA:8C:9D:53:EC:3F:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ipk-gatersleben.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 84337F2DFF2E2A506607BFC102FC092EA37656D0FE5DFA1E4EADA0D3BD0FB130
    SPKI SHA256: 6E37ACF9BA2FEF1C61D3C1B4A48CAD60811779D50BB333199AA539C81FD36166
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IPK Gatersleben CA - G02

- Subject: countryName=DE, organizationName=IPK Gatersleben, commonName=IPK Gatersleben CA - G02, emailAddress=ca@ipk-gatersleben.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CF9BAF8
- SHA-256: F40AF2DCE72351C8CEA66E5DE59F1534876479DFCAA75A5E0B06422F19AED527
- SPKI SHA-256: 6E37ACF9BA2FEF1C61D3C1B4A48CAD60811779D50BB333199AA539C81FD36166
- Validity: 2008-09-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 217692920 (0xcf9baf8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 24 13:15:20 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = IPK Gatersleben, CN = IPK Gatersleben CA - G02, emailAddress = ca@ipk-gatersleben.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                53:97:75:E7:4C:FB:B9:5C:6C:18:47:23:F5:AA:8C:9D:53:EC:3F:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ipk-gatersleben.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F40AF2DCE72351C8CEA66E5DE59F1534876479DFCAA75A5E0B06422F19AED527
    SPKI SHA256: 6E37ACF9BA2FEF1C61D3C1B4A48CAD60811779D50BB333199AA539C81FD36166
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ISAS CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., organizationalUnitName=IT, commonName=ISAS CA - G01, emailAddress=pki@isas.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C53509E6
- SHA-256: 0841A49C3585B25B138C80BEA40761B9378BBDFDC0AE51E6C3E1DFD847A52564
- SPKI SHA-256: 566CF20F37B86CA0F49B3B70D6D1D67E9E6D80D967AE5137DF5B556003FAB389
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398869748198 (0x17aff6c53509e6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:41 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., OU = IT, CN = ISAS CA - G01, emailAddress = pki@isas.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CC:AD:07:3C:38:74:2E:D7:5C:6B:B0:8E:4E:C2:AC:31:FA:8B:E2:AD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@isas.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0841A49C3585B25B138C80BEA40761B9378BBDFDC0AE51E6C3E1DFD847A52564
    SPKI SHA256: 566CF20F37B86CA0F49B3B70D6D1D67E9E6D80D967AE5137DF5B556003FAB389
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ISAS CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Dortmund, organizationName=Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., organizationalUnitName=IT, commonName=ISAS CA - G01, emailAddress=pki@isas.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F4712A6
- SHA-256: B78234588E1DC2703BE237AF5F60ECBC25083315521386F6C8EAD769D9EBB9D5
- SPKI SHA-256: 566CF20F37B86CA0F49B3B70D6D1D67E9E6D80D967AE5137DF5B556003FAB389
- Validity: 2009-12-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 256316070 (0xf4712a6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 15 13:54:31 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Dortmund, O = Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.V., OU = IT, CN = ISAS CA - G01, emailAddress = pki@isas.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CC:AD:07:3C:38:74:2E:D7:5C:6B:B0:8E:4E:C2:AC:31:FA:8B:E2:AD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@isas.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B78234588E1DC2703BE237AF5F60ECBC25083315521386F6C8EAD769D9EBB9D5
    SPKI SHA256: 566CF20F37B86CA0F49B3B70D6D1D67E9E6D80D967AE5137DF5B556003FAB389
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### IWM CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Tuebingen, organizationName=Stiftung Medien in der Bildung Leibniz-Institut f. Wissensmedien, organizationalUnitName=Medientechnik, commonName=IWM CA - G01, emailAddress=ca@iwm-tuebingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1930BAC4A0BA1E
- SHA-256: F0B32C22734916D7609F4DDCC26854722E34C39F640F680BDE10853D986474E9
- SPKI SHA-256: AF8A79F4D20F81A0B064DE34CCD6054B2F8B2833A52091C51DC518C3577C2AEC
- Validity: 2015-03-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7090453138684446 (0x1930bac4a0ba1e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 24 10:32:20 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Tuebingen, O = Stiftung Medien in der Bildung Leibniz-Institut f. Wissensmedien, OU = Medientechnik, CN = IWM CA - G01, emailAddress = ca@iwm-tuebingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                71:27:35:3D:0E:AA:22:58:AE:4F:A1:F4:FA:26:9F:31:EA:B5:B1:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@iwm-tuebingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F0B32C22734916D7609F4DDCC26854722E34C39F640F680BDE10853D986474E9
    SPKI SHA256: AF8A79F4D20F81A0B064DE34CCD6054B2F8B2833A52091C51DC518C3577C2AEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Jacobs University CA - G01

- Subject: countryName=DE, organizationName=Jacobs University Bremen gGmbH, organizationalUnitName=IRC-IT, commonName=Jacobs University CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A15EFCF
- SHA-256: 136EADFB8B129D65D110105CCF600874CED9153E049DBBA761F628B5DDC4B87C
- SPKI SHA-256: B8081C06F7C0A5AFA4A5FA4D6A1A1D5663BAF63D5D43481F207DB9F4A4699BB4
- Validity: 2007-03-13 to 2019-03-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169209807 (0xa15efcf)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 13 09:43:28 2007 GMT
            Not After : Mar 12 00:00:00 2019 GMT
        Subject: C = DE, O = Jacobs University Bremen gGmbH, OU = IRC-IT, CN = Jacobs University CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1C:AB:41:DA:D4:95:D4:9D:1E:82:CD:4D:7D:13:25:37:EC:1F:88:A7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 136EADFB8B129D65D110105CCF600874CED9153E049DBBA761F628B5DDC4B87C
    SPKI SHA256: B8081C06F7C0A5AFA4A5FA4D6A1A1D5663BAF63D5D43481F207DB9F4A4699BB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Jacobs University CA - G01

- Subject: countryName=DE, organizationName=Jacobs University Bremen gGmbH, organizationalUnitName=IRC-IT, commonName=Jacobs University CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F7689C16
- SHA-256: 705D5B5BE21492D3A5A62C5DF28AA0D728C5F66A8EA9EA6092523AD982F75111
- SPKI SHA-256: B8081C06F7C0A5AFA4A5FA4D6A1A1D5663BAF63D5D43481F207DB9F4A4699BB4
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670606433302 (0x179060f7689c16)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:15 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Jacobs University Bremen gGmbH, OU = IRC-IT, CN = Jacobs University CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1C:AB:41:DA:D4:95:D4:9D:1E:82:CD:4D:7D:13:25:37:EC:1F:88:A7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 705D5B5BE21492D3A5A62C5DF28AA0D728C5F66A8EA9EA6092523AD982F75111
    SPKI SHA256: B8081C06F7C0A5AFA4A5FA4D6A1A1D5663BAF63D5D43481F207DB9F4A4699BB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### JGU CA - G01

- Subject: countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Johannes Gutenberg-Universitaet Mainz, commonName=JGU CA - G01, emailAddress=jgu-ca@uni-mainz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7018B905E
- SHA-256: A431D30999C113AB6EAD04E0D94BE70EA4A0E50654ABB2BCA95998C802096D7D
- SPKI SHA-256: B75008567EF1A19F0863EAF31654A68DE743B25CC2782C6355443BB96EE1CC6C
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399882051678 (0x17aff7018b905e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:42 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Rheinland-Pfalz, L = Mainz, O = Johannes Gutenberg-Universitaet Mainz, CN = JGU CA - G01, emailAddress = jgu-ca@uni-mainz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:18:39:3D:55:34:58:70:A3:AC:AF:F0:8C:FB:9A:47:22:3D:4F:CD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:jgu-ca@uni-mainz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A431D30999C113AB6EAD04E0D94BE70EA4A0E50654ABB2BCA95998C802096D7D
    SPKI SHA256: B75008567EF1A19F0863EAF31654A68DE743B25CC2782C6355443BB96EE1CC6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### JGU CA - G01

- Subject: countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Johannes Gutenberg-Universitaet Mainz, commonName=JGU CA - G01, emailAddress=jgu-ca@uni-mainz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 13913DED19123D
- SHA-256: 6A95212ADA2572BA5FA6705E37E4018A8D963B2C676D2FDF7335638D67A83E6C
- SPKI SHA-256: B75008567EF1A19F0863EAF31654A68DE743B25CC2782C6355443BB96EE1CC6C
- Validity: 2012-03-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5507719714378301 (0x13913ded19123d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 13:27:57 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Rheinland-Pfalz, L = Mainz, O = Johannes Gutenberg-Universitaet Mainz, CN = JGU CA - G01, emailAddress = jgu-ca@uni-mainz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                33:18:39:3D:55:34:58:70:A3:AC:AF:F0:8C:FB:9A:47:22:3D:4F:CD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:jgu-ca@uni-mainz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6A95212ADA2572BA5FA6705E37E4018A8D963B2C676D2FDF7335638D67A83E6C
    SPKI SHA256: B75008567EF1A19F0863EAF31654A68DE743B25CC2782C6355443BB96EE1CC6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Julius Kuehn-Institut CA - G01

- Subject: countryName=DE, organizationName=Julius Kuehn-Institut, commonName=Julius Kuehn-Institut CA - G01, emailAddress=ca@jki.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94D8B79C1F
- SHA-256: 48F87C0885B8A7432D9B9D65B71D7A274E0830F06C4422309449CF7CC47A2D70
- SPKI SHA-256: 5A21B7028EE35E260DD21EA57F3D353E22E3EFDA3793BE2F4CA126F60302F98B
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612002708888607 (0x177d94d8b79c1f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:33 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Julius Kuehn-Institut, CN = Julius Kuehn-Institut CA - G01, emailAddress = ca@jki.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                70:CF:D8:C3:C6:C3:80:7D:3F:87:5B:9D:7F:5E:3D:C0:3A:F1:01:A9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@jki.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 48F87C0885B8A7432D9B9D65B71D7A274E0830F06C4422309449CF7CC47A2D70
    SPKI SHA256: 5A21B7028EE35E260DD21EA57F3D353E22E3EFDA3793BE2F4CA126F60302F98B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Kath. Universitaet Eichstaett-Ingolstadt CA - G01

- Subject: countryName=DE, organizationName=Kath. Universitaet Eichstaett-Ingolstadt, organizationalUnitName=Universitaetsrechenzentrum, commonName=Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress=pki@ku-eichstaett.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DE992F
- SHA-256: 9C95197ABC6EB0D903670C948730F4F0961463D59BCBAAB031ED62DC34277FD1
- SPKI SHA-256: 6AF325164DE95F6B19F4A91F443001F3B3B693D4D8BAA9B7F554264BE9AB09FD
- Validity: 2007-01-30 to 2019-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165583151 (0x9de992f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 30 10:19:13 2007 GMT
            Not After : Jan 29 00:00:00 2019 GMT
        Subject: C = DE, O = Kath. Universitaet Eichstaett-Ingolstadt, OU = Universitaetsrechenzentrum, CN = Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress = pki@ku-eichstaett.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A1:67:5F:FA:56:67:E7:0A:F4:79:69:86:88:03:07:B3:69:F5:00:86
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ku-eichstaett.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9C95197ABC6EB0D903670C948730F4F0961463D59BCBAAB031ED62DC34277FD1
    SPKI SHA256: 6AF325164DE95F6B19F4A91F443001F3B3B693D4D8BAA9B7F554264BE9AB09FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Kath. Universitaet Eichstaett-Ingolstadt CA - G01

- Subject: countryName=DE, organizationName=Kath. Universitaet Eichstaett-Ingolstadt, organizationalUnitName=Universitaetsrechenzentrum, commonName=Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress=pki@ku-eichstaett.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D32AFE42
- SHA-256: C8249C2559AF0416A4DBF06E92B4CD320F2E5F0E1829AE966D2C3FF43F614CCA
- SPKI SHA-256: 6AF325164DE95F6B19F4A91F443001F3B3B693D4D8BAA9B7F554264BE9AB09FD
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669998415426 (0x179060d32afe42)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Kath. Universitaet Eichstaett-Ingolstadt, OU = Universitaetsrechenzentrum, CN = Kath. Universitaet Eichstaett-Ingolstadt CA - G01, emailAddress = pki@ku-eichstaett.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A1:67:5F:FA:56:67:E7:0A:F4:79:69:86:88:03:07:B3:69:F5:00:86
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ku-eichstaett.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8249C2559AF0416A4DBF06E92B4CD320F2E5F0E1829AE966D2C3FF43F614CCA
    SPKI SHA256: 6AF325164DE95F6B19F4A91F443001F3B3B693D4D8BAA9B7F554264BE9AB09FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KatHO NRW CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Katholische Fachhochschule gGmbH, organizationalUnitName=IuK, commonName=KatHO NRW CA - G01, emailAddress=ca@katho-nrw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 19211468310DD2
- SHA-256: E6E79FB3B4BD2BAE7CAAB18966982F1E9121AA92651BA0DC7978C71116378520
- SPKI SHA-256: EDB1A9CF24F82C1737FFA32FD4B75E773034395E25DB4399A8E834DAEB8BB0EA
- Validity: 2015-03-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7073245948874194 (0x19211468310dd2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 12 13:38:32 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Katholische Fachhochschule gGmbH, OU = IuK, CN = KatHO NRW CA - G01, emailAddress = ca@katho-nrw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                20:E0:80:AC:3F:10:AD:7D:02:7E:C1:D1:3A:DA:C1:E7:05:D6:6B:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@katho-nrw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E6E79FB3B4BD2BAE7CAAB18966982F1E9121AA92651BA0DC7978C71116378520
    SPKI SHA256: EDB1A9CF24F82C1737FFA32FD4B75E773034395E25DB4399A8E834DAEB8BB0EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KH Berlin Weissensee CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Kunsthochschule Berlin (Weissensee) - Hochschule fuer Gestaltung, organizationalUnitName=ServiceCenter-IT, commonName=KH Berlin Weissensee CA - G01, emailAddress=sc-it@kh-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1921145A166D22
- SHA-256: 4FA7D510273832E03E7E7180D878A1606E1DB1656B6E0175D3B4D70C531B0122
- SPKI SHA-256: F2A3CE0AABEEC1298D7BCA21316B8C211DCE5682E034853A7A0089EE61F0A2DF
- Validity: 2015-03-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7073245712248098 (0x1921145a166d22)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 12 13:38:19 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Kunsthochschule Berlin (Weissensee) - Hochschule fuer Gestaltung, OU = ServiceCenter-IT, CN = KH Berlin Weissensee CA - G01, emailAddress = sc-it@kh-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                EB:01:94:94:C9:AD:13:B7:2D:C2:AE:B1:8A:AF:25:FB:0E:67:54:81
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:sc-it@kh-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4FA7D510273832E03E7E7180D878A1606E1DB1656B6E0175D3B4D70C531B0122
    SPKI SHA256: F2A3CE0AABEEC1298D7BCA21316B8C211DCE5682E034853A7A0089EE61F0A2DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KIT-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, commonName=KIT-CA
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1C3AD48C24ED922EB0F490AE
- SHA-256: 01B9F3D08E31A9E8E1600D118C2ABFD856875EA60827020469865BA242EEBE1C
- SPKI SHA-256: 0EF662543D23B731800D9C544276E19C7B058C3F0955AA718C28CFE9A2C17A86
- Validity: 2016-11-03 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/kit-ca-g2/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:3a:d4:8c:24:ed:92:2e:b0:f4:90:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Nov  3 15:25:48 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Karlsruhe Institute of Technology, CN = KIT-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                04:1A:BF:1C:93:91:3D:D3:D9:3D:B0:DE:13:23:E5:9A:70:F4:2E:08
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 01B9F3D08E31A9E8E1600D118C2ABFD856875EA60827020469865BA242EEBE1C
    SPKI SHA256: 0EF662543D23B731800D9C544276E19C7B058C3F0955AA718C28CFE9A2C17A86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KIT-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, organizationalUnitName=Steinbuch Centre for Computing, commonName=KIT-CA, emailAddress=ca@kit.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CCDF8A7
- SHA-256: 030E63865522783241A83F5B4A50D410103F886B17FD2E784C0E7F34E552681C
- SPKI SHA-256: 3091F02B02B781158B7AE25394E50276B5CAAD02DCCB513730F03A066227B347
- Validity: 2008-08-22 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 214825127 (0xccdf8a7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 22 08:38:47 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Karlsruhe Institute of Technology, OU = Steinbuch Centre for Computing, CN = KIT-CA, emailAddress = ca@kit.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1F:74:65:F4:9A:1D:7A:F6:31:E9:DF:61:1B:73:2B:0D:6D:D0:33:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@kit.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 030E63865522783241A83F5B4A50D410103F886B17FD2E784C0E7F34E552681C
    SPKI SHA256: 3091F02B02B781158B7AE25394E50276B5CAAD02DCCB513730F03A066227B347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### KIT-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Karlsruhe Institute of Technology, organizationalUnitName=Steinbuch Centre for Computing, commonName=KIT-CA, emailAddress=ca@kit.edu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF76F2322E9
- SHA-256: 47DFBE04CD83C044126D6891B10EDBF3C9BF6F494177C9C05CE5623AB78C3DA9
- SPKI SHA-256: 3091F02B02B781158B7AE25394E50276B5CAAD02DCCB513730F03A066227B347
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401720701673 (0x17aff76f2322e9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:31 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Karlsruhe Institute of Technology, OU = Steinbuch Centre for Computing, CN = KIT-CA, emailAddress = ca@kit.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1F:74:65:F4:9A:1D:7A:F6:31:E9:DF:61:1B:73:2B:0D:6D:D0:33:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@kit.edu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 47DFBE04CD83C044126D6891B10EDBF3C9BF6F494177C9C05CE5623AB78C3DA9
    SPKI SHA256: 3091F02B02B781158B7AE25394E50276B5CAAD02DCCB513730F03A066227B347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Kuehne Logistics University GmbH CA

- Subject: countryName=DE, organizationName=Kuehne Logistics University GmbH, commonName=Kuehne Logistics University GmbH CA, emailAddress=pki@the-klu.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10F79102
- SHA-256: A941CC6A1CFD336C768E5FE586C2921FE41932E8A86B4E58E27E9AEA167AF4D0
- SPKI SHA-256: AB05E00AAA0B768151AC3F577BCE72CE96ABC1B0AB69DF8C0DEA2B8E9ED8A83E
- Validity: 2010-11-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 284659970 (0x10f79102)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  8 15:12:50 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Kuehne Logistics University GmbH, CN = Kuehne Logistics University GmbH CA, emailAddress = pki@the-klu.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                35:59:E6:D7:DC:3D:6D:9A:FF:48:B7:34:E6:53:2E:CC:30:34:68:B6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@the-klu.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A941CC6A1CFD336C768E5FE586C2921FE41932E8A86B4E58E27E9AEA167AF4D0
    SPKI SHA256: AB05E00AAA0B768151AC3F577BCE72CE96ABC1B0AB69DF8C0DEA2B8E9ED8A83E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Kuehne Logistics University GmbH CA

- Subject: countryName=DE, organizationName=Kuehne Logistics University GmbH, commonName=Kuehne Logistics University GmbH CA, emailAddress=pki@the-klu.org
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6EA1EFA37
- SHA-256: AB6C57BB6CB8DA89D057791C75B35F26BEA17181E81B94EACADF54586EDB650B
- SPKI SHA-256: AB05E00AAA0B768151AC3F577BCE72CE96ABC1B0AB69DF8C0DEA2B8E9ED8A83E
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399489059383 (0x17aff6ea1efa37)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Kuehne Logistics University GmbH, CN = Kuehne Logistics University GmbH CA, emailAddress = pki@the-klu.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                35:59:E6:D7:DC:3D:6D:9A:FF:48:B7:34:E6:53:2E:CC:30:34:68:B6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@the-klu.org
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB6C57BB6CB8DA89D057791C75B35F26BEA17181E81B94EACADF54586EDB650B
    SPKI SHA256: AB05E00AAA0B768151AC3F577BCE72CE96ABC1B0AB69DF8C0DEA2B8E9ED8A83E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Kunstakademie Karlsruhe CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Staatliche Akademie der Bildenden Kuenste Karlsruhe, commonName=Kunstakademie Karlsruhe CA - G01, emailAddress=ca@kunstakademie-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181AB53BF6AFB0
- SHA-256: FDFECC460C7829EB16983908B2D98F8E6BC75276FDBD6DB6204273DBC38A6756
- SPKI SHA-256: DB3FB274C6FE1D1D487728D12C16BDB49B946B66B36406E6B901EB0756F044FF
- Validity: 2014-08-25 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6784765138481072 (0x181ab53bf6afb0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 25 13:18:35 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Staatliche Akademie der Bildenden Kuenste Karlsruhe, CN = Kunstakademie Karlsruhe CA - G01, emailAddress = ca@kunstakademie-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                54:C5:D4:20:32:6B:45:17:53:3D:85:48:A6:82:81:B5:4D:B4:25:94
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@kunstakademie-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FDFECC460C7829EB16983908B2D98F8E6BC75276FDBD6DB6204273DBC38A6756
    SPKI SHA256: DB3FB274C6FE1D1D487728D12C16BDB49B946B66B36406E6B901EB0756F044FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Landeshauptstadt Erfurt Stadtverwaltung CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Erfurt, organizationName=Landeshauptstadt Erfurt Stadtverwaltung, commonName=Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress=pki@erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1196FB7E
- SHA-256: 14C31520012773498DB865DA76295A45171853A990323431CB249BCE91E1B113
- SPKI SHA-256: 4BE86F18D5BA16A1CB1E45811CCA6104EE92D2088BC9E26B6F37DD736098AB9D
- Validity: 2011-03-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 295107454 (0x1196fb7e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  9 13:17:34 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Erfurt, O = Landeshauptstadt Erfurt Stadtverwaltung, CN = Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress = pki@erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B9:E8:F5:1A:45:92:43:41:EF:13:DF:86:22:C5:71:9D:B1:26:6F:88
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 14C31520012773498DB865DA76295A45171853A990323431CB249BCE91E1B113
    SPKI SHA256: 4BE86F18D5BA16A1CB1E45811CCA6104EE92D2088BC9E26B6F37DD736098AB9D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Landeshauptstadt Erfurt Stadtverwaltung CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Erfurt, organizationName=Landeshauptstadt Erfurt Stadtverwaltung, commonName=Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress=pki@erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6EF71D713
- SHA-256: 222E9A3FCBF13AC995850791F366E6A4A31D1A3E685426307D212C17A5E21590
- SPKI SHA-256: 4BE86F18D5BA16A1CB1E45811CCA6104EE92D2088BC9E26B6F37DD736098AB9D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399578375955 (0x17aff6ef71d713)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Erfurt, O = Landeshauptstadt Erfurt Stadtverwaltung, CN = Landeshauptstadt Erfurt Stadtverwaltung CA - G01, emailAddress = pki@erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B9:E8:F5:1A:45:92:43:41:EF:13:DF:86:22:C5:71:9D:B1:26:6F:88
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 222E9A3FCBF13AC995850791F366E6A4A31D1A3E685426307D212C17A5E21590
    SPKI SHA256: 4BE86F18D5BA16A1CB1E45811CCA6104EE92D2088BC9E26B6F37DD736098AB9D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Altersforschung (FLI) CA - G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Altersforschung - FLI e. V., organizationalUnitName=SG IT, commonName=Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress=sgit@fli-leibniz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF713F4059E
- SHA-256: B3C73EA302975D99D07D314D96D2A4933378189B15DD8C7150F9CF3E8C20B2FA
- SPKI SHA-256: FCCF93348E32C6701761DECF35D8846789CDB6EEC570195ED5A3F9DE0CB3D4A2
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400190887326 (0x17aff713f4059e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:59 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Altersforschung - FLI e. V., OU = SG IT, CN = Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress = sgit@fli-leibniz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                77:F6:4F:31:34:00:71:F3:04:B7:6E:2F:DC:E1:0E:1F:E7:23:10:5F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:sgit@fli-leibniz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B3C73EA302975D99D07D314D96D2A4933378189B15DD8C7150F9CF3E8C20B2FA
    SPKI SHA256: FCCF93348E32C6701761DECF35D8846789CDB6EEC570195ED5A3F9DE0CB3D4A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Altersforschung (FLI) CA - G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Altersforschung - FLI e. V., organizationalUnitName=SG IT, commonName=Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress=sgit@fli-leibniz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15344D47EDF34A
- SHA-256: 17918B7B3F08F093E8D982A829A40CBF637847FCF3F8862869982191C82B421E
- SPKI SHA-256: FCCF93348E32C6701761DECF35D8846789CDB6EEC570195ED5A3F9DE0CB3D4A2
- Validity: 2013-02-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5968481034826570 (0x15344d47edf34a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  8 10:13:11 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Altersforschung - FLI e. V., OU = SG IT, CN = Leibniz-Institut fuer Altersforschung (FLI) CA - G01, emailAddress = sgit@fli-leibniz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                77:F6:4F:31:34:00:71:F3:04:B7:6E:2F:DC:E1:0E:1F:E7:23:10:5F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:sgit@fli-leibniz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 17918B7B3F08F093E8D982A829A40CBF637847FCF3F8862869982191C82B421E
    SPKI SHA256: FCCF93348E32C6701761DECF35D8846789CDB6EEC570195ED5A3F9DE0CB3D4A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Arbeitsforschung Dortmund CA

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Arbeitsforschung Dortmund, commonName=Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress=pki@ifado.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FC48ED20
- SHA-256: 44FDCBBED964AC61E32E557EB4C943E597AB93DCE03C96D51697DB252C827DA9
- SPKI SHA-256: EE33169D9A5EDA1045CFEAC92F807E4F85056CE07D6636579CD3B5AE480F2615
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399793798432 (0x17aff6fc48ed20)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Arbeitsforschung Dortmund, CN = Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress = pki@ifado.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                43:BD:20:A6:46:63:19:86:4D:D7:2E:9F:62:E9:E9:8C:F3:CA:84:87
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifado.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 44FDCBBED964AC61E32E557EB4C943E597AB93DCE03C96D51697DB252C827DA9
    SPKI SHA256: EE33169D9A5EDA1045CFEAC92F807E4F85056CE07D6636579CD3B5AE480F2615
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Arbeitsforschung Dortmund CA

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Arbeitsforschung Dortmund, commonName=Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress=pki@ifado.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12F598EFF9BBE9
- SHA-256: B6BB72CC80CD1379A52A13BDD8407F4CFB12579B8FE12CC522345E4D2ED316D9
- SPKI SHA-256: EE33169D9A5EDA1045CFEAC92F807E4F85056CE07D6636579CD3B5AE480F2615
- Validity: 2011-11-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5336586790747113 (0x12f598eff9bbe9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 30 12:02:39 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Arbeitsforschung Dortmund, CN = Leibniz-Institut fuer Arbeitsforschung Dortmund CA, emailAddress = pki@ifado.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                43:BD:20:A6:46:63:19:86:4D:D7:2E:9F:62:E9:E9:8C:F3:CA:84:87
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ifado.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B6BB72CC80CD1379A52A13BDD8407F4CFB12579B8FE12CC522345E4D2ED316D9
    SPKI SHA256: EE33169D9A5EDA1045CFEAC92F807E4F85056CE07D6636579CD3B5AE480F2615
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Leibniz-Institut fuer Astrophysik Potsdam (AIP), commonName=Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 143B3E5D35D9D2
- SHA-256: 105389A44AB5E9E613E65BCEBFE98C2D9BA1D91778AB7B0FD8F6F428BE6C30E3
- SPKI SHA-256: 339C1A361F308314B64BD1B7160A845CC4AFF76B0964001F6807D32F675D02D7
- Validity: 2012-08-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5694638572034514 (0x143b3e5d35d9d2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  3 12:15:09 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Potsdam, O = Leibniz-Institut fuer Astrophysik Potsdam (AIP), CN = Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                42:59:51:23:AF:8D:F5:54:1D:E3:99:8A:4D:87:F2:75:13:3F:A4:40
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 105389A44AB5E9E613E65BCEBFE98C2D9BA1D91778AB7B0FD8F6F428BE6C30E3
    SPKI SHA256: 339C1A361F308314B64BD1B7160A845CC4AFF76B0964001F6807D32F675D02D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Leibniz-Institut fuer Astrophysik Potsdam (AIP), commonName=Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17887D0A77414C
- SHA-256: 2F3B76A8D51966CC4F405545226B21574412B67A5C07F667A4AF3FBA7898709C
- SPKI SHA-256: 339C1A361F308314B64BD1B7160A845CC4AFF76B0964001F6807D32F675D02D7
- Validity: 2014-05-06 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6623995092222284 (0x17887d0a77414c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  6 15:27:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Potsdam, O = Leibniz-Institut fuer Astrophysik Potsdam (AIP), CN = Leibniz-Institut fuer Astrophysik Potsdam (AIP) CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                42:59:51:23:AF:8D:F5:54:1D:E3:99:8A:4D:87:F2:75:13:3F:A4:40
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2F3B76A8D51966CC4F405545226B21574412B67A5C07F667A4AF3FBA7898709C
    SPKI SHA256: 339C1A361F308314B64BD1B7160A845CC4AFF76B0964001F6807D32F675D02D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Nutztierbiologie CA - G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Nutztierbiologie, commonName=Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress=edv-zentral@fbn-dummerstorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF70F245896
- SHA-256: 6431B308D7D1D61EBAC097E816DBB54BF7856F2D158D3D0F6FDAA9B9BC9C8858
- SPKI SHA-256: F28CB327F51DB34CBF0BF286695F48D6E6E20BF2D4C97283518F8D374995656D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400110168214 (0x17aff70f245896)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Nutztierbiologie, CN = Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress = edv-zentral@fbn-dummerstorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5E:2E:96:22:0A:96:C2:EC:91:13:F9:10:27:C1:DA:F9:55:D4:95:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:edv-zentral@fbn-dummerstorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6431B308D7D1D61EBAC097E816DBB54BF7856F2D158D3D0F6FDAA9B9BC9C8858
    SPKI SHA256: F28CB327F51DB34CBF0BF286695F48D6E6E20BF2D4C97283518F8D374995656D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leibniz-Institut fuer Nutztierbiologie CA - G01

- Subject: countryName=DE, organizationName=Leibniz-Institut fuer Nutztierbiologie, commonName=Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress=edv-zentral@fbn-dummerstorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14E94DAE17AA7C
- SHA-256: DDED598CE7E82DCA1D366688AEE2A7F55CD063967AD13078EC96504042DB8270
- SPKI SHA-256: F28CB327F51DB34CBF0BF286695F48D6E6E20BF2D4C97283518F8D374995656D
- Validity: 2012-12-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5886019376753276 (0x14e94dae17aa7c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 13 12:54:55 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Leibniz-Institut fuer Nutztierbiologie, CN = Leibniz-Institut fuer Nutztierbiologie CA - G01, emailAddress = edv-zentral@fbn-dummerstorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5E:2E:96:22:0A:96:C2:EC:91:13:F9:10:27:C1:DA:F9:55:D4:95:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:edv-zentral@fbn-dummerstorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DDED598CE7E82DCA1D366688AEE2A7F55CD063967AD13078EC96504042DB8270
    SPKI SHA256: F28CB327F51DB34CBF0BF286695F48D6E6E20BF2D4C97283518F8D374995656D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Leuphana Universitaet Lueneburg CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Lueneburg, organizationName=Leuphana Universitaet Lueneburg, organizationalUnitName=Rechen- und Medienzentrum, commonName=Leuphana Universitaet Lueneburg CA, emailAddress=ca@leuphana.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BCA51D6
- SHA-256: AE50B719BDA970593F0544938CDC033FD78180FFDB10EE15F3308C1004A88787
- SPKI SHA-256: B2B8A28391A67A412FD6772D1DAD9D0D18DFE478A479A103FB6C8B17B3B98A89
- Validity: 2008-02-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 197808598 (0xbca51d6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  7 09:50:00 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Lueneburg, O = Leuphana Universitaet Lueneburg, OU = Rechen- und Medienzentrum, CN = Leuphana Universitaet Lueneburg CA, emailAddress = ca@leuphana.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F4:E1:68:19:3B:19:43:C7:01:36:D1:34:62:96:F3:F5:03:A1:07:8C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@leuphana.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AE50B719BDA970593F0544938CDC033FD78180FFDB10EE15F3308C1004A88787
    SPKI SHA256: B2B8A28391A67A412FD6772D1DAD9D0D18DFE478A479A103FB6C8B17B3B98A89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Leuphana Universitaet Lueneburg CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Lueneburg, organizationName=Leuphana Universitaet Lueneburg, organizationalUnitName=Rechen- und Medienzentrum, commonName=Leuphana Universitaet Lueneburg CA, emailAddress=ca@leuphana.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A71EA3E4
- SHA-256: 47E846EB7E5219E6B8D120C1820825ADECDDC531BB82FBECD1C782632AB2211D
- SPKI SHA-256: B2B8A28391A67A412FD6772D1DAD9D0D18DFE478A479A103FB6C8B17B3B98A89
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401793926116 (0x17a424a71ea3e4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:16 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Lueneburg, O = Leuphana Universitaet Lueneburg, OU = Rechen- und Medienzentrum, CN = Leuphana Universitaet Lueneburg CA, emailAddress = ca@leuphana.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F4:E1:68:19:3B:19:43:C7:01:36:D1:34:62:96:F3:F5:03:A1:07:8C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@leuphana.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 47E846EB7E5219E6B8D120C1820825ADECDDC531BB82FBECD1C782632AB2211D
    SPKI SHA256: B2B8A28391A67A412FD6772D1DAD9D0D18DFE478A479A103FB6C8B17B3B98A89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### LIKAT CA

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Leibniz-Institut fuer Katalyse e.V., commonName=LIKAT CA, emailAddress=ca@catalysis.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A727067
- SHA-256: 407B3037FD192323DD4F68BDBFF395F3DABD07FD120909FF65979D877EC5B5A6
- SPKI SHA-256: 6142AFB168638F534D9E3F8E33C8C8BB768613A8EEB027855AF80A1ADBFBE041
- Validity: 2007-05-22 to 2019-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175272039 (0xa727067)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 22 13:40:41 2007 GMT
            Not After : May 21 00:00:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Rostock, O = Leibniz-Institut fuer Katalyse e.V., CN = LIKAT CA, emailAddress = ca@catalysis.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                DA:E2:23:0A:B0:7C:CD:61:B2:CE:36:F3:EF:06:15:B0:20:B4:E7:4A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@catalysis.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 407B3037FD192323DD4F68BDBFF395F3DABD07FD120909FF65979D877EC5B5A6
    SPKI SHA256: 6142AFB168638F534D9E3F8E33C8C8BB768613A8EEB027855AF80A1ADBFBE041
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### LIKAT CA

- Subject: countryName=DE, stateOrProvinceName=Mecklenburg-Vorpommern, localityName=Rostock, organizationName=Leibniz-Institut fuer Katalyse e.V., commonName=LIKAT CA, emailAddress=ca@catalysis.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247111660C
- SHA-256: BC460DE1914489E846B704CBE8312D4CE9DCFC2BFBC0A3705FDEA3BA93D84B32
- SPKI SHA-256: 6142AFB168638F534D9E3F8E33C8C8BB768613A8EEB027855AF80A1ADBFBE041
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400887088652 (0x17a4247111660c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:22 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Mecklenburg-Vorpommern, L = Rostock, O = Leibniz-Institut fuer Katalyse e.V., CN = LIKAT CA, emailAddress = ca@catalysis.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DA:E2:23:0A:B0:7C:CD:61:B2:CE:36:F3:EF:06:15:B0:20:B4:E7:4A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@catalysis.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC460DE1914489E846B704CBE8312D4CE9DCFC2BFBC0A3705FDEA3BA93D84B32
    SPKI SHA256: 6142AFB168638F534D9E3F8E33C8C8BB768613A8EEB027855AF80A1ADBFBE041
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### LMU-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Ludwig-Maximilians-Universitaet Muenchen, commonName=LMU-CA, emailAddress=pki@lmu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AFE4293
- SHA-256: 3862E82759AFD85117330F58C1EBBFEE2AE2EC1FBB51C3871A6E71DD1E34D4BE
- SPKI SHA-256: A76568ED4E7F81F795D41B6735C6B6479684ECF32F09DB042C474B1F615B0A50
- Validity: 2007-09-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 184435347 (0xafe4293)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep  5 15:02:29 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Ludwig-Maximilians-Universitaet Muenchen, CN = LMU-CA, emailAddress = pki@lmu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:87:78:6A:2F:FA:9B:BC:23:4F:94:A6:A3:77:1D:1E:0E:94:80:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@lmu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3862E82759AFD85117330F58C1EBBFEE2AE2EC1FBB51C3871A6E71DD1E34D4BE
    SPKI SHA256: A76568ED4E7F81F795D41B6735C6B6479684ECF32F09DB042C474B1F615B0A50
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### LMU-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Ludwig-Maximilians-Universitaet Muenchen, commonName=LMU-CA, emailAddress=pki@lmu.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4250F6D0E34
- SHA-256: F66E22B5D45B5303838209CE66C2B02D4D2556E9C8A6EF6C9CCA0D77FCA745F7
- SPKI SHA-256: A76568ED4E7F81F795D41B6735C6B6479684ECF32F09DB042C474B1F615B0A50
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403543895604 (0x17a4250f6d0e34)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Ludwig-Maximilians-Universitaet Muenchen, CN = LMU-CA, emailAddress = pki@lmu.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                79:87:78:6A:2F:FA:9B:BC:23:4F:94:A6:A3:77:1D:1E:0E:94:80:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@lmu.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F66E22B5D45B5303838209CE66C2B02D4D2556E9C8A6EF6C9CCA0D77FCA745F7
    SPKI SHA256: A76568ED4E7F81F795D41B6735C6B6479684ECF32F09DB042C474B1F615B0A50
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### LRZ-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247AF40721
- SHA-256: B82AC6991AE61DEC2A217B2E425858434B886902A8368E43204B81D8B9D109B5
- SPKI SHA-256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
- Validity: 2007-01-23 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401052935969 (0x17a4247af40721)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 23 13:03:38 2007 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Leibniz-Rechenzentrum, OU = LRZ-CA, CN = LRZ-CA - G01, emailAddress = pki@lrz-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                96:5B:4C:70:BB:6F:FC:9C:EF:B5:3F:A4:7A:FB:93:FF:09:EA:6A:76
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@lrz-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B82AC6991AE61DEC2A217B2E425858434B886902A8368E43204B81D8B9D109B5
    SPKI SHA256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### LRZ-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A972436
- SHA-256: F687AE9FDBEE043B16F116CBBC931565A76BFB2E6E544DF51BFA6352435B9E6A
- SPKI SHA-256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
- Validity: 2007-01-23 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677366 (0xa972436)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 23 13:03:38 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Leibniz-Rechenzentrum, OU = LRZ-CA, CN = LRZ-CA - G01, emailAddress = pki@lrz-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                96:5B:4C:70:BB:6F:FC:9C:EF:B5:3F:A4:7A:FB:93:FF:09:EA:6A:76
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@lrz-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F687AE9FDBEE043B16F116CBBC931565A76BFB2E6E544DF51BFA6352435B9E6A
    SPKI SHA256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### LRZ-CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Leibniz-Rechenzentrum, organizationalUnitName=LRZ-CA, commonName=LRZ-CA - G01, emailAddress=pki@lrz-muenchen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09D58537
- SHA-256: 623776C1111FBF59D19BB8B9A01C3CF59EA9F1206BD46CD72467AA60F531F944
- SPKI SHA-256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
- Validity: 2007-01-23 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 164988215 (0x9d58537)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 23 13:03:38 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Leibniz-Rechenzentrum, OU = LRZ-CA, CN = LRZ-CA - G01, emailAddress = pki@lrz-muenchen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                96:5B:4C:70:BB:6F:FC:9C:EF:B5:3F:A4:7A:FB:93:FF:09:EA:6A:76
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@lrz-muenchen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 623776C1111FBF59D19BB8B9A01C3CF59EA9F1206BD46CD72467AA60F531F944
    SPKI SHA256: 15D30E622ACDEDCA60EEEAA7B0ED95032298A4F1E1A2672A5A019869D5AE1B9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### LSKN CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Land Niedersachsen, organizationalUnitName=Landesbetrieb fuer Statistik und Kommunikationstechnologie, commonName=LSKN CA, emailAddress=ca@lskn.niedersachsen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6BAC958FF
- SHA-256: 656C6F60FE7364D4A9FB3C6FBC0E12F5C29A93A54A2FEFEA9CD626B2ED812CAB
- SPKI SHA-256: BC63651D2655EC99E603435F91EDC10CCFAE4C541498B7E19B6D4643E8DA18FD
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398694918399 (0x17aff6bac958ff)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:30 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Land Niedersachsen, OU = Landesbetrieb fuer Statistik und Kommunikationstechnologie, CN = LSKN CA, emailAddress = ca@lskn.niedersachsen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:8A:5B:EA:18:94:9C:66:41:DA:1C:A1:8A:76:DF:D7:22:2E:03:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@lskn.niedersachsen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 656C6F60FE7364D4A9FB3C6FBC0E12F5C29A93A54A2FEFEA9CD626B2ED812CAB
    SPKI SHA256: BC63651D2655EC99E603435F91EDC10CCFAE4C541498B7E19B6D4643E8DA18FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### LSKN CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Land Niedersachsen, organizationalUnitName=Landesbetrieb fuer Statistik und Kommunikationstechnologie, commonName=LSKN CA, emailAddress=ca@lskn.niedersachsen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E8FCDDD
- SHA-256: 2DBE2C2DE1D8B1C103E2DC71FA713A73C28F7F4D3E18A106680E70487976A530
- SPKI SHA-256: BC63651D2655EC99E603435F91EDC10CCFAE4C541498B7E19B6D4643E8DA18FD
- Validity: 2009-07-29 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 244305373 (0xe8fcddd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 29 13:36:13 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Land Niedersachsen, OU = Landesbetrieb fuer Statistik und Kommunikationstechnologie, CN = LSKN CA, emailAddress = ca@lskn.niedersachsen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F1:8A:5B:EA:18:94:9C:66:41:DA:1C:A1:8A:76:DF:D7:22:2E:03:F9
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@lskn.niedersachsen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2DBE2C2DE1D8B1C103E2DC71FA713A73C28F7F4D3E18A106680E70487976A530
    SPKI SHA256: BC63651D2655EC99E603435F91EDC10CCFAE4C541498B7E19B6D4643E8DA18FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Oberwolfach, organizationName=Mathematisches Forschungsinstitut Oberwolfach gGmbH, commonName=Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress=ca@mfo.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A4EADFF3
- SHA-256: 2712624F45AEC56D12F901E571A749964F0CD08EA5C0C7400275AD7CEDE691E7
- SPKI SHA-256: C7B9B40C87C3014914739C8F057FC79A9398935AA6CA88C605A2AF43CC2F3694
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398328016883 (0x17aff6a4eadff3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:08 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Oberwolfach, O = Mathematisches Forschungsinstitut Oberwolfach gGmbH, CN = Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress = ca@mfo.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                47:76:48:94:EA:80:55:28:3A:5C:D4:22:1D:E0:90:40:C4:F2:9B:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mfo.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2712624F45AEC56D12F901E571A749964F0CD08EA5C0C7400275AD7CEDE691E7
    SPKI SHA256: C7B9B40C87C3014914739C8F057FC79A9398935AA6CA88C605A2AF43CC2F3694
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Oberwolfach, organizationName=Mathematisches Forschungsinstitut Oberwolfach gGmbH, commonName=Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress=ca@mfo.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D688CB7
- SHA-256: 08F6D1983FBC00CFEE7A555C235C33D52AABA5DF73209F16ED089137CE89F86B
- SPKI SHA-256: C7B9B40C87C3014914739C8F057FC79A9398935AA6CA88C605A2AF43CC2F3694
- Validity: 2008-12-17 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 224955575 (0xd688cb7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 17 14:39:36 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Oberwolfach, O = Mathematisches Forschungsinstitut Oberwolfach gGmbH, CN = Mathematisches Forschungsinstitut Oberwolfach gGmbH CA - G01, emailAddress = ca@mfo.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                47:76:48:94:EA:80:55:28:3A:5C:D4:22:1D:E0:90:40:C4:F2:9B:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mfo.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 08F6D1983FBC00CFEE7A555C235C33D52AABA5DF73209F16ED089137CE89F86B
    SPKI SHA256: C7B9B40C87C3014914739C8F057FC79A9398935AA6CA88C605A2AF43CC2F3694
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Max Rubner-Institut CA - G01

- Subject: countryName=DE, organizationName=Max Rubner-Institut, commonName=Max Rubner-Institut CA - G01, emailAddress=ca@mri.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71FD7DDCA
- SHA-256: 78C2E9BA3A72CABA5B76FA1FA6E22826DFF63D22DAD5DA90A0858CCDAE33298C
- SPKI SHA-256: 64809408356775ED34F216022D0A1DDFB69DC32F279EFBEF222D6F76427D2E18
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400390368714 (0x17aff71fd7ddca)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Max Rubner-Institut, CN = Max Rubner-Institut CA - G01, emailAddress = ca@mri.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                47:DE:B3:CA:AC:8C:57:13:E2:EE:E9:C9:3E:A9:DB:92:D9:F9:09:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mri.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 78C2E9BA3A72CABA5B76FA1FA6E22826DFF63D22DAD5DA90A0858CCDAE33298C
    SPKI SHA256: 64809408356775ED34F216022D0A1DDFB69DC32F279EFBEF222D6F76427D2E18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Max Rubner-Institut CA - G01

- Subject: countryName=DE, organizationName=Max Rubner-Institut, commonName=Max Rubner-Institut CA - G01, emailAddress=ca@mri.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 16D0F429C8288A
- SHA-256: 0F2B9EFFF2C6392AD2FCACF5F4A9C4F7ACA32809DE1DE7E761C3B86DBF5B458F
- SPKI SHA-256: 64809408356775ED34F216022D0A1DDFB69DC32F279EFBEF222D6F76427D2E18
- Validity: 2013-12-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6422196579215498 (0x16d0f429c8288a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 18 10:19:05 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Max Rubner-Institut, CN = Max Rubner-Institut CA - G01, emailAddress = ca@mri.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                47:DE:B3:CA:AC:8C:57:13:E2:EE:E9:C9:3E:A9:DB:92:D9:F9:09:99
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mri.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0F2B9EFFF2C6392AD2FCACF5F4A9C4F7ACA32809DE1DE7E761C3B86DBF5B458F
    SPKI SHA256: 64809408356775ED34F216022D0A1DDFB69DC32F279EFBEF222D6F76427D2E18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Max-Planck-Institut fuer Biophysik ZIT-CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt, organizationName=Max-Planck-Institut fuer Biophysik, organizationalUnitName=Zentrale IT, commonName=Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress=CA@mpibp-frankfurt.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6AB194FEA
- SHA-256: AB60134C8896EAD92DF29A6B7C19950AF6AECC9B3D85136F492A52DC4EEB46A0
- SPKI SHA-256: F7EC706D49E9940F8A6BE7193E55493E73E4783160F121173488F2CA73206449
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398431723498 (0x17aff6ab194fea)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:15 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Frankfurt, O = Max-Planck-Institut fuer Biophysik, OU = Zentrale IT, CN = Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress = CA@mpibp-frankfurt.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                36:97:7D:70:DB:7A:42:CF:1A:20:18:D0:F9:4B:3A:C0:79:7F:EC:14
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@mpibp-frankfurt.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB60134C8896EAD92DF29A6B7C19950AF6AECC9B3D85136F492A52DC4EEB46A0
    SPKI SHA256: F7EC706D49E9940F8A6BE7193E55493E73E4783160F121173488F2CA73206449
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Max-Planck-Institut fuer Biophysik ZIT-CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt, organizationName=Max-Planck-Institut fuer Biophysik, organizationalUnitName=Zentrale IT, commonName=Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress=CA@mpibp-frankfurt.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DFC126E
- SHA-256: 9F179E160ABF7694F626053F8E825B7E2BB11480522EFB6BE8F7852AF7D59572
- SPKI SHA-256: F7EC706D49E9940F8A6BE7193E55493E73E4783160F121173488F2CA73206449
- Validity: 2009-04-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 234623598 (0xdfc126e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  8 12:13:19 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Frankfurt, O = Max-Planck-Institut fuer Biophysik, OU = Zentrale IT, CN = Max-Planck-Institut fuer Biophysik ZIT-CA, emailAddress = CA@mpibp-frankfurt.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                36:97:7D:70:DB:7A:42:CF:1A:20:18:D0:F9:4B:3A:C0:79:7F:EC:14
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@mpibp-frankfurt.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9F179E160ABF7694F626053F8E825B7E2BB11480522EFB6BE8F7852AF7D59572
    SPKI SHA256: F7EC706D49E9940F8A6BE7193E55493E73E4783160F121173488F2CA73206449
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MDR CA

- Subject: countryName=DE, organizationName=Mitteldeutscher Rundfunk, commonName=MDR CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247F44D71F
- SHA-256: 37E153AA97B0347C8140F99C42822BB35A43314D4B0F23C9BBBE4F94C7A4456D
- SPKI SHA-256: D60DF2054C6D562DDA881DB158F7BAC7818AA20F8FD5BC8F6C436390F8C221A1
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401125340959 (0x17a4247f44d71f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Mitteldeutscher Rundfunk, CN = MDR CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                96:F4:38:BC:EA:50:6F:44:D7:59:09:F6:90:12:E7:F9:AE:BE:74:81
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 37E153AA97B0347C8140F99C42822BB35A43314D4B0F23C9BBBE4F94C7A4456D
    SPKI SHA256: D60DF2054C6D562DDA881DB158F7BAC7818AA20F8FD5BC8F6C436390F8C221A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MDR CA

- Subject: countryName=DE, organizationName=Mitteldeutscher Rundfunk, commonName=MDR CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AA33332
- SHA-256: CF3501A32518E44A0F23D1292F718102B9CEBFC50710343A33E9BF597484AC82
- SPKI SHA-256: D60DF2054C6D562DDA881DB158F7BAC7818AA20F8FD5BC8F6C436390F8C221A1
- Validity: 2007-06-28 to 2019-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 178467634 (0xaa33332)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 28 13:20:36 2007 GMT
            Not After : Jun 27 00:00:00 2019 GMT
        Subject: C = DE, O = Mitteldeutscher Rundfunk, CN = MDR CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                96:F4:38:BC:EA:50:6F:44:D7:59:09:F6:90:12:E7:F9:AE:BE:74:81
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CF3501A32518E44A0F23D1292F718102B9CEBFC50710343A33E9BF597484AC82
    SPKI SHA256: D60DF2054C6D562DDA881DB158F7BAC7818AA20F8FD5BC8F6C436390F8C221A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MH Freiburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg i. Br., organizationName=Hochschule fuer Musik Freiburg i. Br., commonName=MH Freiburg CA - G01, emailAddress=ca@mh-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 190566193563F1
- SHA-256: 193991DADF91F85038FBE4092CA3B3E5B576E02822B6B74BEE51439E40633AD8
- SPKI SHA-256: 99D8674DA32C3502297FDC3A0FA870774654395200773531B312DCF5EA63EA06
- Validity: 2015-02-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7042810485498865 (0x190566193563f1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 13:43:38 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Freiburg i. Br., O = Hochschule fuer Musik Freiburg i. Br., CN = MH Freiburg CA - G01, emailAddress = ca@mh-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                4A:59:CF:EF:CE:B7:DE:D3:51:17:74:7B:3F:68:22:78:CE:26:E0:6C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 193991DADF91F85038FBE4092CA3B3E5B576E02822B6B74BEE51439E40633AD8
    SPKI SHA256: 99D8674DA32C3502297FDC3A0FA870774654395200773531B312DCF5EA63EA06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MH Stuttgart CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=MH Stuttgart CA, emailAddress=ca@mh-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4252D0BF96F
- SHA-256: AD2A0A64A94EBB2664D76204805221014D96BB65D992B874EDA502E829DD1BFD
- SPKI SHA-256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404040849775 (0x17a4252d0bf96f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Stuttgart, O = Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, CN = MH Stuttgart CA, emailAddress = ca@mh-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7F:1B:AC:47:6F:E3:9F:B1:5F:A3:0C:B3:C5:C2:EF:D0:52:AE:5B:B8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD2A0A64A94EBB2664D76204805221014D96BB65D992B874EDA502E829DD1BFD
    SPKI SHA256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MH Stuttgart CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, commonName=MH Stuttgart CA, emailAddress=ca@mh-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AC5702E
- SHA-256: DE431C7C59548F39782C14B014F80E8F7982F8FA075B16FB8245728B3E615976
- SPKI SHA-256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
- Validity: 2007-07-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180711470 (0xac5702e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 24 12:37:52 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Stuttgart, O = Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart, CN = MH Stuttgart CA, emailAddress = ca@mh-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7F:1B:AC:47:6F:E3:9F:B1:5F:A3:0C:B3:C5:C2:EF:D0:52:AE:5B:B8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DE431C7C59548F39782C14B014F80E8F7982F8FA075B16FB8245728B3E615976
    SPKI SHA256: A2E39024B1FB5B94B7C1844BFAEA44A7BA637249A98EE1195887F5CA83CCDE61
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MHH CA

- Subject: countryName=DE, organizationName=Medizinische Hochschule Hannover, commonName=MHH CA, emailAddress=pki@mh-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D12AD50
- SHA-256: 5BC53B8B2C823E8D3E26E2CF1F3D15428FF66E1344FCC2DA9C26151AAED37EAA
- SPKI SHA-256: FB89101C56F72937DD3194336D103CC288C549404B408B2635E0E3DBFDB40A3F
- Validity: 2008-10-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 219327824 (0xd12ad50)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 13 11:23:45 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Medizinische Hochschule Hannover, CN = MHH CA, emailAddress = pki@mh-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                25:9B:81:9A:68:FC:F6:02:4C:BB:77:5F:1C:4C:68:33:B3:6E:46:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@mh-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5BC53B8B2C823E8D3E26E2CF1F3D15428FF66E1344FCC2DA9C26151AAED37EAA
    SPKI SHA256: FB89101C56F72937DD3194336D103CC288C549404B408B2635E0E3DBFDB40A3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MHH CA

- Subject: countryName=DE, organizationName=Medizinische Hochschule Hannover, commonName=MHH CA, emailAddress=pki@mh-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69A20799F
- SHA-256: D5F31CA8F487613706564C0AAC9EBD287935A92A64DF3276E022A11037486443
- SPKI SHA-256: FB89101C56F72937DD3194336D103CC288C549404B408B2635E0E3DBFDB40A3F
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398146980255 (0x17aff69a20799f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Medizinische Hochschule Hannover, CN = MHH CA, emailAddress = pki@mh-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                25:9B:81:9A:68:FC:F6:02:4C:BB:77:5F:1C:4C:68:33:B3:6E:46:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@mh-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D5F31CA8F487613706564C0AAC9EBD287935A92A64DF3276E022A11037486443
    SPKI SHA256: FB89101C56F72937DD3194336D103CC288C549404B408B2635E0E3DBFDB40A3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPG CA

- Subject: countryName=DE, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA, emailAddress=mpg-ca@mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ACEB1D8
- SHA-256: 8BA5C566B10E445578D8F801363E770D3226787A5131BEFC3301D14E3774AA67
- SPKI SHA-256: D479E9618108D601C49842AFFDDA7196F284B1F8A3C18393D1A880F52C023BE1
- Validity: 2007-07-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 181318104 (0xaceb1d8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 31 13:08:25 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Gesellschaft, CN = MPG CA, emailAddress = mpg-ca@mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                02:D6:1E:6E:09:AB:BF:58:65:A7:0A:3C:48:33:61:D1:CE:7D:C3:5B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:mpg-ca@mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8BA5C566B10E445578D8F801363E770D3226787A5131BEFC3301D14E3774AA67
    SPKI SHA256: D479E9618108D601C49842AFFDDA7196F284B1F8A3C18393D1A880F52C023BE1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MPG CA

- Subject: countryName=DE, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA, emailAddress=mpg-ca@mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248A6BC150
- SHA-256: AFED624C073E3923F928DCF2EDE5F2C1DE259D1C2A23C4222F8477DE6FEF804A
- SPKI SHA-256: D479E9618108D601C49842AFFDDA7196F284B1F8A3C18393D1A880F52C023BE1
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401312440656 (0x17a4248a6bc150)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:46 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Gesellschaft, CN = MPG CA, emailAddress = mpg-ca@mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                02:D6:1E:6E:09:AB:BF:58:65:A7:0A:3C:48:33:61:D1:CE:7D:C3:5B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:mpg-ca@mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AFED624C073E3923F928DCF2EDE5F2C1DE259D1C2A23C4222F8477DE6FEF804A
    SPKI SHA256: D479E9618108D601C49842AFFDDA7196F284B1F8A3C18393D1A880F52C023BE1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPG CA - G02

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Max-Planck-Gesellschaft, commonName=MPG CA - G02
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1C3AD450847EEEF358F88E77
- SHA-256: FC2245BE59DC6461D4119C3A06EDBEE4D288556BD88C479E30ED5F3E81616469
- SPKI SHA-256: 28407D813D331B464C82BD3F9A1391295BCD6CD28C0C4BE8F3D82EAE32CBCD89
- Validity: 2016-11-03 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/mpg-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:3a:d4:50:84:7e:ee:f3:58:f8:8e:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Nov  3 15:24:48 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Max-Planck-Gesellschaft, CN = MPG CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                C4:88:A5:07:EE:B8:7B:AA:0C:13:BF:DA:29:74:63:52:1B:49:70:16
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FC2245BE59DC6461D4119C3A06EDBEE4D288556BD88C479E30ED5F3E81616469
    SPKI SHA256: 28407D813D331B464C82BD3F9A1391295BCD6CD28C0C4BE8F3D82EAE32CBCD89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MPI Gemeinschaftsgueter CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, commonName=MPI Gemeinschaftsgueter CA, emailAddress=ca@coll.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A629926
- SHA-256: 2E737ED0F66E63D523311D0EA65231760173817161D3008E71295CF7CE0162AB
- SPKI SHA-256: 001CBF4421079B286F7CE0184CFC7C270D8712895ED4E585C25EE35E495404C3
- Validity: 2007-05-10 to 2019-05-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 174233894 (0xa629926)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 10 13:18:16 2007 GMT
            Not After : May  8 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, CN = MPI Gemeinschaftsgueter CA, emailAddress = ca@coll.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F9:08:35:85:7C:58:02:92:61:07:3D:5F:AE:E8:E2:19:C1:3F:5E:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@coll.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2E737ED0F66E63D523311D0EA65231760173817161D3008E71295CF7CE0162AB
    SPKI SHA256: 001CBF4421079B286F7CE0184CFC7C270D8712895ED4E585C25EE35E495404C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MPI Gemeinschaftsgueter CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, commonName=MPI Gemeinschaftsgueter CA, emailAddress=ca@coll.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4246ED60FF4
- SHA-256: 3125A75B8A827E9BA32900742F8D96ADA179B8030A492DA2BBDF8F74453A677B
- SPKI SHA-256: 001CBF4421079B286F7CE0184CFC7C270D8712895ED4E585C25EE35E495404C3
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400849645556 (0x17a4246ed60ff4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern, CN = MPI Gemeinschaftsgueter CA, emailAddress = ca@coll.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F9:08:35:85:7C:58:02:92:61:07:3D:5F:AE:E8:E2:19:C1:3F:5E:1F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@coll.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3125A75B8A827E9BA32900742F8D96ADA179B8030A492DA2BBDF8F74453A677B
    SPKI SHA256: 001CBF4421079B286F7CE0184CFC7C270D8712895ED4E585C25EE35E495404C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPIE-CA - G01

- Subject: countryName=DE, organizationName=Max-Planck-Institut fuer Eisenforschung GmbH, organizationalUnitName=Network Centre, commonName=MPIE-CA - G01, emailAddress=ca@mpie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 166A3B8F65BC9D
- SHA-256: C537DEC41EEAA3867886D998CE3DE584A83946B080801434EBB2EBF271DE15BF
- SPKI SHA-256: 74306D152E396D4713DB916750CAE9D2ADEE53E3478D57291430A17E8A56DE65
- Validity: 2013-10-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6309253529058461 (0x166a3b8f65bc9d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  1 12:20:15 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Institut fuer Eisenforschung GmbH, OU = Network Centre, CN = MPIE-CA - G01, emailAddress = ca@mpie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FC:36:3B:D3:AC:78:74:FF:C6:10:4B:72:C4:4A:DE:B4:39:08:AF:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C537DEC41EEAA3867886D998CE3DE584A83946B080801434EBB2EBF271DE15BF
    SPKI SHA256: 74306D152E396D4713DB916750CAE9D2ADEE53E3478D57291430A17E8A56DE65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPIE-CA - G01

- Subject: countryName=DE, organizationName=Max-Planck-Institut fuer Eisenforschung GmbH, organizationalUnitName=Network Centre, commonName=MPIE-CA - G01, emailAddress=ca@mpie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71D97A8F5
- SHA-256: E367FBAB2DDB7B0D7795D9EDD610FD5683936AD3A0839D3B60E343D695446CAE
- SPKI SHA-256: 74306D152E396D4713DB916750CAE9D2ADEE53E3478D57291430A17E8A56DE65
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400352606453 (0x17aff71d97a8f5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Institut fuer Eisenforschung GmbH, OU = Network Centre, CN = MPIE-CA - G01, emailAddress = ca@mpie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FC:36:3B:D3:AC:78:74:FF:C6:10:4B:72:C4:4A:DE:B4:39:08:AF:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E367FBAB2DDB7B0D7795D9EDD610FD5683936AD3A0839D3B60E343D695446CAE
    SPKI SHA256: 74306D152E396D4713DB916750CAE9D2ADEE53E3478D57291430A17E8A56DE65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPIfG-CA

- Subject: countryName=DE, organizationName=Max-Planck-Institut fuer Gesellschaftsforschung, organizationalUnitName=MPIfG, commonName=MPIfG-CA, emailAddress=ca@mpifg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42573B2D5F6
- SHA-256: FBAB9A46C4E4043330FABB7B9DDDF924EF8E97D80512F0C04F69C098E00BB017
- SPKI SHA-256: 6FE1F460267B84C7054A3B51EA3088B84556FC3C59559D8D0FDE94E1FA3C28F8
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654405226190326 (0x17a42573b2d5f6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:57:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Institut fuer Gesellschaftsforschung, OU = MPIfG, CN = MPIfG-CA, emailAddress = ca@mpifg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0A:73:A6:A5:B4:49:88:09:BC:61:53:F4:2C:34:07:E1:F4:8F:AD:60
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpifg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FBAB9A46C4E4043330FABB7B9DDDF924EF8E97D80512F0C04F69C098E00BB017
    SPKI SHA256: 6FE1F460267B84C7054A3B51EA3088B84556FC3C59559D8D0FDE94E1FA3C28F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MPIfG-CA

- Subject: countryName=DE, organizationName=Max-Planck-Institut fuer Gesellschaftsforschung, organizationalUnitName=MPIfG, commonName=MPIfG-CA, emailAddress=ca@mpifg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09D5A5AD
- SHA-256: A2D659CD95B2A2D38D2AE592FA941EED8AEAD70680D710C9F827EDABCA0BC845
- SPKI SHA-256: 6FE1F460267B84C7054A3B51EA3088B84556FC3C59559D8D0FDE94E1FA3C28F8
- Validity: 2007-01-23 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 164996525 (0x9d5a5ad)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 23 15:22:06 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, O = Max-Planck-Institut fuer Gesellschaftsforschung, OU = MPIfG, CN = MPIfG-CA, emailAddress = ca@mpifg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0A:73:A6:A5:B4:49:88:09:BC:61:53:F4:2C:34:07:E1:F4:8F:AD:60
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpifg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A2D659CD95B2A2D38D2AE592FA941EED8AEAD70680D710C9F827EDABCA0BC845
    SPKI SHA256: 6FE1F460267B84C7054A3B51EA3088B84556FC3C59559D8D0FDE94E1FA3C28F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MPIZ CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Max-Planck-Institut fuer Zuechtungsforschung, organizationalUnitName=SUSAN, commonName=MPIZ CA, emailAddress=ca@mpiz-koeln.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D30F76B
- SHA-256: D1723979FE761E0BBE3E0ED805EFF174637CF34A1B1D58C91C08AC67A1CE4D49
- SPKI SHA-256: F74D689F3D98E6C4914E0179E9C17E1D085FE9BF7424769B167A2B18F1201136
- Validity: 2008-11-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 221312875 (0xd30f76b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  5 10:47:55 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Max-Planck-Institut fuer Zuechtungsforschung, OU = SUSAN, CN = MPIZ CA, emailAddress = ca@mpiz-koeln.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                42:D4:9D:B5:A6:91:7B:24:52:4D:B8:3F:08:19:AF:2F:53:B2:89:A3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpiz-koeln.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D1723979FE761E0BBE3E0ED805EFF174637CF34A1B1D58C91C08AC67A1CE4D49
    SPKI SHA256: F74D689F3D98E6C4914E0179E9C17E1D085FE9BF7424769B167A2B18F1201136
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MPIZ CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Max-Planck-Institut fuer Zuechtungsforschung, organizationalUnitName=SUSAN, commonName=MPIZ CA, emailAddress=ca@mpiz-koeln.mpg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69F208882
- SHA-256: 86C548906D994BD7A4B2527E91224812F87B1EE51DE8C898E6EC90929DDC3D6A
- SPKI SHA-256: F74D689F3D98E6C4914E0179E9C17E1D085FE9BF7424769B167A2B18F1201136
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398230870146 (0x17aff69f208882)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Max-Planck-Institut fuer Zuechtungsforschung, OU = SUSAN, CN = MPIZ CA, emailAddress = ca@mpiz-koeln.mpg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                42:D4:9D:B5:A6:91:7B:24:52:4D:B8:3F:08:19:AF:2F:53:B2:89:A3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mpiz-koeln.mpg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 86C548906D994BD7A4B2527E91224812F87B1EE51DE8C898E6EC90929DDC3D6A
    SPKI SHA256: F74D689F3D98E6C4914E0179E9C17E1D085FE9BF7424769B167A2B18F1201136
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MUHO Mannheim CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Staatliche Hochschule fuer Musik und Darstellende Kunst Mannheim, commonName=MUHO Mannheim CA - G01, emailAddress=ca@muho-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 181AB534EC6095
- SHA-256: 185DA45CBDE43EF6471B13DAA1839CAC8AAA86812CC3B252C87C91B6F6B7C9F0
- SPKI SHA-256: 8D442D3B5AC6A5DE461922C1B665C2CC96DD8BB05123D572C1D33117D4460C5C
- Validity: 2014-08-25 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6784765020364949 (0x181ab534ec6095)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 25 13:18:28 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Staatliche Hochschule fuer Musik und Darstellende Kunst Mannheim, CN = MUHO Mannheim CA - G01, emailAddress = ca@muho-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                EC:FF:16:55:71:8C:8B:61:00:3F:58:A5:17:C3:EC:BC:5F:92:37:C5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@muho-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 185DA45CBDE43EF6471B13DAA1839CAC8AAA86812CC3B252C87C91B6F6B7C9F0
    SPKI SHA256: 8D442D3B5AC6A5DE461922C1B665C2CC96DD8BB05123D572C1D33117D4460C5C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Musikhochschule Luebeck CA - G01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Musikhochschule Luebeck, organizationalUnitName=Sachgebiet EDV, commonName=Musikhochschule Luebeck CA - G01, emailAddress=ca@mh-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 134A20F131571F
- SHA-256: E8B23785F387AB9F0529D84D9AB0C263B6094EAB261DFA87F4B81DD967036F93
- SPKI SHA-256: 7885CB5A855635E2C403FA3A2F161BBCD23CFE7F61106140CDBACF90DF70DC06
- Validity: 2012-02-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5429529903453983 (0x134a20f131571f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  2 14:53:21 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Luebeck, O = Musikhochschule Luebeck, OU = Sachgebiet EDV, CN = Musikhochschule Luebeck CA - G01, emailAddress = ca@mh-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                71:CA:90:00:E7:86:9F:F8:89:3B:37:AE:8B:2F:75:B7:A6:A8:AC:7A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E8B23785F387AB9F0529D84D9AB0C263B6094EAB261DFA87F4B81DD967036F93
    SPKI SHA256: 7885CB5A855635E2C403FA3A2F161BBCD23CFE7F61106140CDBACF90DF70DC06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Musikhochschule Luebeck CA - G01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Luebeck, organizationName=Musikhochschule Luebeck, organizationalUnitName=Sachgebiet EDV, commonName=Musikhochschule Luebeck CA - G01, emailAddress=ca@mh-luebeck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FE302727
- SHA-256: 8D0BC07E93943206237B83530067630B7B7B3AD76E698A4483125198B2E98C15
- SPKI SHA-256: 7885CB5A855635E2C403FA3A2F161BBCD23CFE7F61106140CDBACF90DF70DC06
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399825729319 (0x17aff6fe302727)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Luebeck, O = Musikhochschule Luebeck, OU = Sachgebiet EDV, CN = Musikhochschule Luebeck CA - G01, emailAddress = ca@mh-luebeck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                71:CA:90:00:E7:86:9F:F8:89:3B:37:AE:8B:2F:75:B7:A6:A8:AC:7A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@mh-luebeck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8D0BC07E93943206237B83530067630B7B7B3AD76E698A4483125198B2E98C15
    SPKI SHA256: 7885CB5A855635E2C403FA3A2F161BBCD23CFE7F61106140CDBACF90DF70DC06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Musikhochschule Trossingen CA-G01

- Subject: countryName=DE, organizationName=Staatliche Hochschule fuer Musik Trossingen, commonName=Musikhochschule Trossingen CA-G01, emailAddress=pki@mh-trossingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F4F08BB
- SHA-256: 94DA7F515084A3269C6071C09D74E8A61410ED50C5E5B0C105CD1399EC17453F
- SPKI SHA-256: 16136C2B8BA0A7D60CAA22060CC76AAA7888F14C7955CFE29CF70920896C0258
- Validity: 2009-12-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 256837819 (0xf4f08bb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 21 14:50:20 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Staatliche Hochschule fuer Musik Trossingen, CN = Musikhochschule Trossingen CA-G01, emailAddress = pki@mh-trossingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                75:17:9E:70:18:B2:A5:74:7A:A5:AF:5A:5D:5D:3A:CD:AE:97:8D:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@mh-trossingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 94DA7F515084A3269C6071C09D74E8A61410ED50C5E5B0C105CD1399EC17453F
    SPKI SHA256: 16136C2B8BA0A7D60CAA22060CC76AAA7888F14C7955CFE29CF70920896C0258
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Musikhochschule Trossingen CA-G01

- Subject: countryName=DE, organizationName=Staatliche Hochschule fuer Musik Trossingen, commonName=Musikhochschule Trossingen CA-G01, emailAddress=pki@mh-trossingen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C76D3D96
- SHA-256: E4CBF57452116E5AE36F19482A0F35A02A6C8551BB33FEB5E5551741EC85553B
- SPKI SHA-256: 16136C2B8BA0A7D60CAA22060CC76AAA7888F14C7955CFE29CF70920896C0258
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398906985878 (0x17aff6c76d3d96)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Staatliche Hochschule fuer Musik Trossingen, CN = Musikhochschule Trossingen CA-G01, emailAddress = pki@mh-trossingen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                75:17:9E:70:18:B2:A5:74:7A:A5:AF:5A:5D:5D:3A:CD:AE:97:8D:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@mh-trossingen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E4CBF57452116E5AE36F19482A0F35A02A6C8551BB33FEB5E5551741EC85553B
    SPKI SHA256: 16136C2B8BA0A7D60CAA22060CC76AAA7888F14C7955CFE29CF70920896C0258
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NECLAB-CA

- Subject: countryName=DE, organizationName=NEC Europe Ltd., organizationalUnitName=NEC Laboratories Europe, commonName=NECLAB-CA, emailAddress=zertifizierungsstelle@nw.neclab.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D210A47
- SHA-256: FFA139E561BC408BC3B46BB4ABB56A5A64D66D04B2747D813DDD74AC11DCCEB0
- SPKI SHA-256: 032210CA9E60F1D4127464E1EA562BEFE851A14C6EC2B2A6B3ADD68CC1BE56C5
- Validity: 2008-10-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 220269127 (0xd210a47)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 24 08:52:08 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = NEC Europe Ltd., OU = NEC Laboratories Europe, CN = NECLAB-CA, emailAddress = zertifizierungsstelle@nw.neclab.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4F:1C:87:7A:1D:E0:2F:99:F6:BE:15:AA:D1:35:9D:0E:4A:E6:BA:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:zertifizierungsstelle@nw.neclab.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FFA139E561BC408BC3B46BB4ABB56A5A64D66D04B2747D813DDD74AC11DCCEB0
    SPKI SHA256: 032210CA9E60F1D4127464E1EA562BEFE851A14C6EC2B2A6B3ADD68CC1BE56C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### NECLAB-CA

- Subject: countryName=DE, organizationName=NEC Europe Ltd., organizationalUnitName=NEC Laboratories Europe, commonName=NECLAB-CA, emailAddress=zertifizierungsstelle@nw.neclab.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF766E3D99F
- SHA-256: C79D008DFB392AFC7ED9BE60806CACDFAE9B4FF659A56FCBA5AF92F0DA455B00
- SPKI SHA-256: 032210CA9E60F1D4127464E1EA562BEFE851A14C6EC2B2A6B3ADD68CC1BE56C5
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401582336415 (0x17aff766e3d99f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = NEC Europe Ltd., OU = NEC Laboratories Europe, CN = NECLAB-CA, emailAddress = zertifizierungsstelle@nw.neclab.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4F:1C:87:7A:1D:E0:2F:99:F6:BE:15:AA:D1:35:9D:0E:4A:E6:BA:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:zertifizierungsstelle@nw.neclab.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C79D008DFB392AFC7ED9BE60806CACDFAE9B4FF659A56FCBA5AF92F0DA455B00
    SPKI SHA256: 032210CA9E60F1D4127464E1EA562BEFE851A14C6EC2B2A6B3ADD68CC1BE56C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NORDAKADEMIE CA-01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Elmshorn, organizationName=NORDAKADEMIE gAG, commonName=NORDAKADEMIE CA-01, emailAddress=pki@nordakademie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BE4D2E4
- SHA-256: 4212B267ADD1E44B8D24FF863999C7A83988820F43A99AAEC614329DA206EDC9
- SPKI SHA-256: 8773EEF2B7EA4EEBA7BA1A5C65F8996BCAD9960F0816E1DA27AA5E743E84F490
- Validity: 2008-02-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 199545572 (0xbe4d2e4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 27 12:19:33 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Elmshorn, O = NORDAKADEMIE gAG, CN = NORDAKADEMIE CA-01, emailAddress = pki@nordakademie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                60:88:46:55:AA:96:6B:41:8B:63:9F:B2:C2:E4:42:65:31:31:CA:6F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@nordakademie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4212B267ADD1E44B8D24FF863999C7A83988820F43A99AAEC614329DA206EDC9
    SPKI SHA256: 8773EEF2B7EA4EEBA7BA1A5C65F8996BCAD9960F0816E1DA27AA5E743E84F490
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### NORDAKADEMIE CA-01

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Elmshorn, organizationName=NORDAKADEMIE gAG, commonName=NORDAKADEMIE CA-01, emailAddress=pki@nordakademie.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424AC6A33A6
- SHA-256: E84EC6CA5631AC5AC90FCA30995C08B942C45387D0E8BBB9B0746E3409A5B207
- SPKI SHA-256: 8773EEF2B7EA4EEBA7BA1A5C65F8996BCAD9960F0816E1DA27AA5E743E84F490
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401882764198 (0x17a424ac6a33a6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:20 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Elmshorn, O = NORDAKADEMIE gAG, CN = NORDAKADEMIE CA-01, emailAddress = pki@nordakademie.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                60:88:46:55:AA:96:6B:41:8B:63:9F:B2:C2:E4:42:65:31:31:CA:6F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@nordakademie.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E84EC6CA5631AC5AC90FCA30995C08B942C45387D0E8BBB9B0746E3409A5B207
    SPKI SHA256: 8773EEF2B7EA4EEBA7BA1A5C65F8996BCAD9960F0816E1DA27AA5E743E84F490
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### OFFIS CA - G01

- Subject: countryName=DE, organizationName=OFFIS e. V., commonName=OFFIS CA - G01, emailAddress=offis-ca@offis.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 18A67745ADFAEA
- SHA-256: 7903C7E5641D415B076491D981D1339E7FFC1F7C6E28024CC20495C283E18A53
- SPKI SHA-256: 64E936A32B7D0B79A75582E87970C8F0C24F5BC5AA4801C98F229EAAFBE2F1F3
- Validity: 2014-12-09 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6938430641404650 (0x18a67745adfaea)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec  9 13:31:33 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, O = OFFIS e. V., CN = OFFIS CA - G01, emailAddress = offis-ca@offis.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                CB:F9:16:36:A1:5F:E6:04:23:1A:EE:25:0E:0C:F8:10:7F:91:53:75
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:offis-ca@offis.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7903C7E5641D415B076491D981D1339E7FFC1F7C6E28024CC20495C283E18A53
    SPKI SHA256: 64E936A32B7D0B79A75582E87970C8F0C24F5BC5AA4801C98F229EAAFBE2F1F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ohm CA - G01

- Subject: countryName=DE, organizationName=Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, organizationalUnitName=Rechenzentrum, commonName=Ohm CA - G01, emailAddress=HS-PKI@ohm-hochschule.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A9236EAE
- SHA-256: E06C8CE70D5883E9095C3A7F24B08995F834485E92F14D397AE6F5E5CDAD4257
- SPKI SHA-256: 436DC41127E1673139F4FB23EF79F187DCB3C1681765443BCC35F1D64270F4DC
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401827794606 (0x17a424a9236eae)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:17 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, OU = Rechenzentrum, CN = Ohm CA - G01, emailAddress = HS-PKI@ohm-hochschule.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                85:24:B0:C9:DE:BE:73:EB:F8:AA:14:50:35:A0:82:CB:57:A8:47:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:HS-PKI@ohm-hochschule.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E06C8CE70D5883E9095C3A7F24B08995F834485E92F14D397AE6F5E5CDAD4257
    SPKI SHA256: 436DC41127E1673139F4FB23EF79F187DCB3C1681765443BCC35F1D64270F4DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ohm CA - G01

- Subject: countryName=DE, organizationName=Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, organizationalUnitName=Rechenzentrum, commonName=Ohm CA - G01, emailAddress=HS-PKI@ohm-hochschule.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BCA51FB
- SHA-256: 0A3FE74FFBC5F4435E94BDC9C826CA4B32EB9A0849EDDED34E31448D27BA43DD
- SPKI SHA-256: 436DC41127E1673139F4FB23EF79F187DCB3C1681765443BCC35F1D64270F4DC
- Validity: 2008-02-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 197808635 (0xbca51fb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  7 09:50:37 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg, OU = Rechenzentrum, CN = Ohm CA - G01, emailAddress = HS-PKI@ohm-hochschule.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                85:24:B0:C9:DE:BE:73:EB:F8:AA:14:50:35:A0:82:CB:57:A8:47:0F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:HS-PKI@ohm-hochschule.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0A3FE74FFBC5F4435E94BDC9C826CA4B32EB9A0849EDDED34E31448D27BA43DD
    SPKI SHA256: 436DC41127E1673139F4FB23EF79F187DCB3C1681765443BCC35F1D64270F4DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Paedagogische Hochschule Weingarten CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Weingarten, organizationName=Paedagogische Hochschule Weingarten, commonName=Paedagogische Hochschule Weingarten CA, emailAddress=phwgtca@ph-weingarten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E22631D
- SHA-256: 8653A5290804240CEA35687E1B9BC6DB99B21AE003B8CD342B2BBF44112E094E
- SPKI SHA-256: F37DB6D147DB90953EE590D81A6FA7AC2311675ACD09B3CCFF2FFC9EFAE765DF
- Validity: 2009-05-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 237134621 (0xe22631d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  7 13:43:41 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Weingarten, O = Paedagogische Hochschule Weingarten, CN = Paedagogische Hochschule Weingarten CA, emailAddress = phwgtca@ph-weingarten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D7:64:A6:44:07:44:93:4F:71:17:71:05:B9:12:78:DB:35:5E:0D:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:phwgtca@ph-weingarten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8653A5290804240CEA35687E1B9BC6DB99B21AE003B8CD342B2BBF44112E094E
    SPKI SHA256: F37DB6D147DB90953EE590D81A6FA7AC2311675ACD09B3CCFF2FFC9EFAE765DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Paedagogische Hochschule Weingarten CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Weingarten, organizationName=Paedagogische Hochschule Weingarten, commonName=Paedagogische Hochschule Weingarten CA, emailAddress=phwgtca@ph-weingarten.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6AF0874C3
- SHA-256: 510817BCEA44CCC9BF5FBE72202FA9EE554AA1081613F804E3844EED0AE505B1
- SPKI SHA-256: F37DB6D147DB90953EE590D81A6FA7AC2311675ACD09B3CCFF2FFC9EFAE765DF
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398497727683 (0x17aff6af0874c3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:19 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Weingarten, O = Paedagogische Hochschule Weingarten, CN = Paedagogische Hochschule Weingarten CA, emailAddress = phwgtca@ph-weingarten.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D7:64:A6:44:07:44:93:4F:71:17:71:05:B9:12:78:DB:35:5E:0D:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:phwgtca@ph-weingarten.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 510817BCEA44CCC9BF5FBE72202FA9EE554AA1081613F804E3844EED0AE505B1
    SPKI SHA256: F37DB6D147DB90953EE590D81A6FA7AC2311675ACD09B3CCFF2FFC9EFAE765DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PH Heidelberg CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Paedagogische Hochschule Heidelberg, organizationalUnitName=IfDI, commonName=PH Heidelberg CA, emailAddress=pki@ph-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C4FD90B3
- SHA-256: 55F0C555DACDCB8B7C41A6A556B03FA34B47857B91611361E102B0A9D1E4DAE8
- SPKI SHA-256: F7D110BCBD03E06D7C5F963C39967F1BCE5745987464E489AAF75D4EF5C92151
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398866112691 (0x17aff6c4fd90b3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:40 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Paedagogische Hochschule Heidelberg, OU = IfDI, CN = PH Heidelberg CA, emailAddress = pki@ph-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D6:18:35:D5:16:DB:0D:D4:D9:8F:DE:AB:2E:93:46:E2:31:E1:41:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 55F0C555DACDCB8B7C41A6A556B03FA34B47857B91611361E102B0A9D1E4DAE8
    SPKI SHA256: F7D110BCBD03E06D7C5F963C39967F1BCE5745987464E489AAF75D4EF5C92151
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PH Heidelberg CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Paedagogische Hochschule Heidelberg, organizationalUnitName=IfDI, commonName=PH Heidelberg CA, emailAddress=pki@ph-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F47129B
- SHA-256: 40716D2522965F6D275E27ED4D591E3D4D0D99427D3D56B95808BDE84C0904DA
- SPKI SHA-256: F7D110BCBD03E06D7C5F963C39967F1BCE5745987464E489AAF75D4EF5C92151
- Validity: 2009-12-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 256316059 (0xf47129b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 15 13:54:19 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Paedagogische Hochschule Heidelberg, OU = IfDI, CN = PH Heidelberg CA, emailAddress = pki@ph-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D6:18:35:D5:16:DB:0D:D4:D9:8F:DE:AB:2E:93:46:E2:31:E1:41:4E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 40716D2522965F6D275E27ED4D591E3D4D0D99427D3D56B95808BDE84C0904DA
    SPKI SHA256: F7D110BCBD03E06D7C5F963C39967F1BCE5745987464E489AAF75D4EF5C92151
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PH Ludwigsburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Paedagogische Hochschule Ludwigsburg, organizationalUnitName=Hochschulrechenzentrum, commonName=PH Ludwigsburg CA - G01, emailAddress=rz-ca@ph-ludwigsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C3BF5367
- SHA-256: FFF38B8F64FA694AF81AC89C4929738495E1E9B850D718A3C7F00F088A9EB4B6
- SPKI SHA-256: 018EC1BA2A2505494C180F12BFE3DB9478C0D43CC3757C11327E7CC2447B8EA8
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398845256551 (0x17aff6c3bf5367)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:39 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ludwigsburg, O = Paedagogische Hochschule Ludwigsburg, OU = Hochschulrechenzentrum, CN = PH Ludwigsburg CA - G01, emailAddress = rz-ca@ph-ludwigsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                19:21:6A:6F:9B:8F:A9:1D:5E:8C:D5:FF:FF:F7:EA:00:82:86:31:88
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rz-ca@ph-ludwigsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FFF38B8F64FA694AF81AC89C4929738495E1E9B850D718A3C7F00F088A9EB4B6
    SPKI SHA256: 018EC1BA2A2505494C180F12BFE3DB9478C0D43CC3757C11327E7CC2447B8EA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PH Ludwigsburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Ludwigsburg, organizationName=Paedagogische Hochschule Ludwigsburg, organizationalUnitName=Hochschulrechenzentrum, commonName=PH Ludwigsburg CA - G01, emailAddress=rz-ca@ph-ludwigsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F335D12
- SHA-256: 4C92D2FD57CDBCB06C279C4F15E45FEB20ED97289F27B0B646F614EBCAB2757B
- SPKI SHA-256: 018EC1BA2A2505494C180F12BFE3DB9478C0D43CC3757C11327E7CC2447B8EA8
- Validity: 2009-11-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 255024402 (0xf335d12)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 30 15:06:42 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Ludwigsburg, O = Paedagogische Hochschule Ludwigsburg, OU = Hochschulrechenzentrum, CN = PH Ludwigsburg CA - G01, emailAddress = rz-ca@ph-ludwigsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                19:21:6A:6F:9B:8F:A9:1D:5E:8C:D5:FF:FF:F7:EA:00:82:86:31:88
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rz-ca@ph-ludwigsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4C92D2FD57CDBCB06C279C4F15E45FEB20ED97289F27B0B646F614EBCAB2757B
    SPKI SHA256: 018EC1BA2A2505494C180F12BFE3DB9478C0D43CC3757C11327E7CC2447B8EA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PH Schwaebisch Gmuend CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Schwaebisch Gmuend, organizationName=Paedagogische Hochschule Schwaebisch Gmuend, organizationalUnitName=MIZ, commonName=PH Schwaebisch Gmuend CA, emailAddress=ra@ph-gmuend.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B0D3EDA6
- SHA-256: B3456CD2605CA1E5AB99A75BFBE05544A45A79CBD9CC786D5CF44B81AFE19A6C
- SPKI SHA-256: 99861B6E61DA9EE804E5AE460360363217BDDC25A7EF0BFCCB00B4C497CFA280
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398527839654 (0x17aff6b0d3eda6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:20 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Schwaebisch Gmuend, O = Paedagogische Hochschule Schwaebisch Gmuend, OU = MIZ, CN = PH Schwaebisch Gmuend CA, emailAddress = ra@ph-gmuend.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5F:F4:91:5A:BB:C0:FB:D7:55:64:22:FB:F8:3F:87:0D:A9:9D:C1:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@ph-gmuend.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B3456CD2605CA1E5AB99A75BFBE05544A45A79CBD9CC786D5CF44B81AFE19A6C
    SPKI SHA256: 99861B6E61DA9EE804E5AE460360363217BDDC25A7EF0BFCCB00B4C497CFA280
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PH Schwaebisch Gmuend CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Schwaebisch Gmuend, organizationName=Paedagogische Hochschule Schwaebisch Gmuend, organizationalUnitName=MIZ, commonName=PH Schwaebisch Gmuend CA, emailAddress=ra@ph-gmuend.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E226324
- SHA-256: ABA11E14B28B49C37B46A401E28581EF69F28217DD91235C0FE7E9920D5313A2
- SPKI SHA-256: 99861B6E61DA9EE804E5AE460360363217BDDC25A7EF0BFCCB00B4C497CFA280
- Validity: 2009-05-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 237134628 (0xe226324)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  7 13:43:49 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Schwaebisch Gmuend, O = Paedagogische Hochschule Schwaebisch Gmuend, OU = MIZ, CN = PH Schwaebisch Gmuend CA, emailAddress = ra@ph-gmuend.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5F:F4:91:5A:BB:C0:FB:D7:55:64:22:FB:F8:3F:87:0D:A9:9D:C1:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ra@ph-gmuend.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: ABA11E14B28B49C37B46A401E28581EF69F28217DD91235C0FE7E9920D5313A2
    SPKI SHA256: 99861B6E61DA9EE804E5AE460360363217BDDC25A7EF0BFCCB00B4C497CFA280
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PH-FR CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg, organizationName=Paedagogische Hochschule Freiburg, organizationalUnitName=ZIK, commonName=PH-FR CA, emailAddress=pki@ph-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E85286F
- SHA-256: 89D0F3C123CBF89D28B7F5DA2E10EA332FB2CB9A62C2D63F44D12321EE39B868
- SPKI SHA-256: 9ACE43778D4E01DB9AE49DD4342ADEE4F0F042FE05666E21FCEF8B394C389C51
- Validity: 2009-07-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 243607663 (0xe85286f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 21 11:47:43 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Freiburg, O = Paedagogische Hochschule Freiburg, OU = ZIK, CN = PH-FR CA, emailAddress = pki@ph-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                71:CD:53:6F:E9:C5:AC:DD:EB:8B:64:4F:3E:38:40:3B:63:8C:45:A2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 89D0F3C123CBF89D28B7F5DA2E10EA332FB2CB9A62C2D63F44D12321EE39B868
    SPKI SHA256: 9ACE43778D4E01DB9AE49DD4342ADEE4F0F042FE05666E21FCEF8B394C389C51
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PH-FR CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Freiburg, organizationName=Paedagogische Hochschule Freiburg, organizationalUnitName=ZIK, commonName=PH-FR CA, emailAddress=pki@ph-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B861AC34
- SHA-256: CF70677B901224A4C6B2646074D742ACB5EF8CA40B7F338E6218FE4D7DD7E1C5
- SPKI SHA-256: 9ACE43778D4E01DB9AE49DD4342ADEE4F0F042FE05666E21FCEF8B394C389C51
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398654569524 (0x17aff6b861ac34)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:28 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Freiburg, O = Paedagogische Hochschule Freiburg, OU = ZIK, CN = PH-FR CA, emailAddress = pki@ph-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                71:CD:53:6F:E9:C5:AC:DD:EB:8B:64:4F:3E:38:40:3B:63:8C:45:A2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF70677B901224A4C6B2646074D742ACB5EF8CA40B7F338E6218FE4D7DD7E1C5
    SPKI SHA256: 9ACE43778D4E01DB9AE49DD4342ADEE4F0F042FE05666E21FCEF8B394C389C51
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PHKA CA

- Subject: countryName=DE, organizationName=Paedagogische Hochschule Karlsruhe, organizationalUnitName=ZIM, commonName=PHKA CA, emailAddress=pki@ph-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C8C1E4D1
- SHA-256: 3C4BA42E11EA77AF1B10CF77B0F1F9289A09C5C07C05F0D69BF56B569DC1AFC5
- SPKI SHA-256: 8A265EA7C6D0275A5A2CA8070D3A53043BBB8621998B69BD6522B18F36CE271B
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398929310929 (0x17aff6c8c1e4d1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Paedagogische Hochschule Karlsruhe, OU = ZIM, CN = PHKA CA, emailAddress = pki@ph-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B7:F6:7C:3B:1D:9B:FB:70:F6:BF:15:3F:78:0E:5C:66:2C:98:72:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C4BA42E11EA77AF1B10CF77B0F1F9289A09C5C07C05F0D69BF56B569DC1AFC5
    SPKI SHA256: 8A265EA7C6D0275A5A2CA8070D3A53043BBB8621998B69BD6522B18F36CE271B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PHKA CA

- Subject: countryName=DE, organizationName=Paedagogische Hochschule Karlsruhe, organizationalUnitName=ZIM, commonName=PHKA CA, emailAddress=pki@ph-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F4F08C3
- SHA-256: 26F64A56EC67012E8A4C197FF6977AAA1AD7A7592D4D8CB0F0DDD7D673B45C9C
- SPKI SHA-256: 8A265EA7C6D0275A5A2CA8070D3A53043BBB8621998B69BD6522B18F36CE271B
- Validity: 2009-12-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 256837827 (0xf4f08c3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 21 14:50:27 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Paedagogische Hochschule Karlsruhe, OU = ZIM, CN = PHKA CA, emailAddress = pki@ph-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B7:F6:7C:3B:1D:9B:FB:70:F6:BF:15:3F:78:0E:5C:66:2C:98:72:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ph-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 26F64A56EC67012E8A4C197FF6977AAA1AD7A7592D4D8CB0F0DDD7D673B45C9C
    SPKI SHA256: 8A265EA7C6D0275A5A2CA8070D3A53043BBB8621998B69BD6522B18F36CE271B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PIK-CA - G01

- Subject: countryName=DE, organizationName=Potsdam-Institut fuer Klimafolgenforschung e. V., commonName=PIK-CA - G01, emailAddress=ca@pik-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 15FF70AE1C7470
- SHA-256: 5D216EA68019B46E613AD9A73D31A297880CC4D15CDFE50FC6DC675A120F7CDD
- SPKI SHA-256: E5560261E07325EDBC44FBA02CA02A7EDC8987113DCA8F7A8B5F84B71A1D8669
- Validity: 2013-07-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6191833933444208 (0x15ff70ae1c7470)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 12 12:14:22 2013 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Potsdam-Institut fuer Klimafolgenforschung e. V., CN = PIK-CA - G01, emailAddress = ca@pik-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                54:B7:93:2E:FB:FC:36:12:7E:DE:7A:1A:72:4D:E1:7D:5C:0B:15:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@pik-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5D216EA68019B46E613AD9A73D31A297880CC4D15CDFE50FC6DC675A120F7CDD
    SPKI SHA256: E5560261E07325EDBC44FBA02CA02A7EDC8987113DCA8F7A8B5F84B71A1D8669
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PIK-CA - G01

- Subject: countryName=DE, organizationName=Potsdam-Institut fuer Klimafolgenforschung e. V., commonName=PIK-CA - G01, emailAddress=ca@pik-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF71ABE6C38
- SHA-256: 92F6CBBBC6EB4FF303EF5091AA099F432FAF606C6A53B7CCC739CC8B31CDECCF
- SPKI SHA-256: E5560261E07325EDBC44FBA02CA02A7EDC8987113DCA8F7A8B5F84B71A1D8669
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400304815160 (0x17aff71abe6c38)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Potsdam-Institut fuer Klimafolgenforschung e. V., CN = PIK-CA - G01, emailAddress = ca@pik-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                54:B7:93:2E:FB:FC:36:12:7E:DE:7A:1A:72:4D:E1:7D:5C:0B:15:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@pik-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 92F6CBBBC6EB4FF303EF5091AA099F432FAF606C6A53B7CCC739CC8B31CDECCF
    SPKI SHA256: E5560261E07325EDBC44FBA02CA02A7EDC8987113DCA8F7A8B5F84B71A1D8669
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PTB CA

- Subject: countryName=DE, organizationName=Physikalisch-Technische Bundesanstalt, commonName=PTB CA, emailAddress=pki@ptb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D210A4D
- SHA-256: 822DFABF14E7963546C7DFC32B816DBA708C16FB542E780A9A58DA6BAE2D20E2
- SPKI SHA-256: 5260BEEB195EB71F8696AD291FF9A2B27C5935E559330ADF50FC892489785ECB
- Validity: 2008-10-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 220269133 (0xd210a4d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 24 08:52:13 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Physikalisch-Technische Bundesanstalt, CN = PTB CA, emailAddress = pki@ptb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C4:80:D0:6E:28:15:68:31:5A:EC:70:5F:78:8E:E1:30:43:38:EA:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ptb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 822DFABF14E7963546C7DFC32B816DBA708C16FB542E780A9A58DA6BAE2D20E2
    SPKI SHA256: 5260BEEB195EB71F8696AD291FF9A2B27C5935E559330ADF50FC892489785ECB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### PTB CA

- Subject: countryName=DE, organizationName=Physikalisch-Technische Bundesanstalt, commonName=PTB CA, emailAddress=pki@ptb.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69D564BFE
- SHA-256: 391DED971EBB7BD25B0ED6B7713F2F81313DEED2F1B7A38E08BC7A8CD2FC6A3C
- SPKI SHA-256: 5260BEEB195EB71F8696AD291FF9A2B27C5935E559330ADF50FC892489785ECB
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398200839166 (0x17aff69d564bfe)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Physikalisch-Technische Bundesanstalt, CN = PTB CA, emailAddress = pki@ptb.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C4:80:D0:6E:28:15:68:31:5A:EC:70:5F:78:8E:E1:30:43:38:EA:34
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@ptb.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 391DED971EBB7BD25B0ED6B7713F2F81313DEED2F1B7A38E08BC7A8CD2FC6A3C
    SPKI SHA256: 5260BEEB195EB71F8696AD291FF9A2B27C5935E559330ADF50FC892489785ECB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### rbb CA

- Subject: countryName=DE, organizationName=Rundfunk Berlin-Brandenburg, commonName=rbb CA, emailAddress=ca-admin@rbb-online.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A67FAB5
- SHA-256: 4612AEB275D1E1FAFEE3551A9BA8E77B149708CF6C1148CDB839B2B73257CC73
- SPKI SHA-256: 31C35FE0121C3F595FE58E7580D627DE86A070B48E48B28FC1EA7612A0124C6C
- Validity: 2007-05-14 to 2019-05-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 174586549 (0xa67fab5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 14 15:15:51 2007 GMT
            Not After : May 13 00:00:00 2019 GMT
        Subject: C = DE, O = Rundfunk Berlin-Brandenburg, CN = rbb CA, emailAddress = ca-admin@rbb-online.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:A5:12:8C:E7:AC:AE:C6:69:C9:04:E6:4B:07:DA:72:CB:CB:5D:8D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-admin@rbb-online.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4612AEB275D1E1FAFEE3551A9BA8E77B149708CF6C1148CDB839B2B73257CC73
    SPKI SHA256: 31C35FE0121C3F595FE58E7580D627DE86A070B48E48B28FC1EA7612A0124C6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### rbb CA

- Subject: countryName=DE, organizationName=Rundfunk Berlin-Brandenburg, commonName=rbb CA, emailAddress=ca-admin@rbb-online.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4246FEF8D7A
- SHA-256: BF311A71F21007CE57883FF7823AE7A346D6B04C468AB6E7125DCC9B37725781
- SPKI SHA-256: 31C35FE0121C3F595FE58E7580D627DE86A070B48E48B28FC1EA7612A0124C6C
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400868093306 (0x17a4246fef8d7a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:19 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Rundfunk Berlin-Brandenburg, CN = rbb CA, emailAddress = ca-admin@rbb-online.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                79:A5:12:8C:E7:AC:AE:C6:69:C9:04:E6:4B:07:DA:72:CB:CB:5D:8D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-admin@rbb-online.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF311A71F21007CE57883FF7823AE7A346D6B04C468AB6E7125DCC9B37725781
    SPKI SHA256: 31C35FE0121C3F595FE58E7580D627DE86A070B48E48B28FC1EA7612A0124C6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RFH Koeln CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Rheinische Fachhochschule Koeln gGmbH, organizationalUnitName=Rechenzentrum, commonName=RFH Koeln CA, emailAddress=pki@rfh-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B5A5FE2
- SHA-256: 1A130DCBA58D0A62C52942E71EAA29B4E340EE67B15C73342C7208304BE817CE
- SPKI SHA-256: 42F308D543414C1315E2CD1AF02257BE7C049024DCB3DDFBC289D22C1D80D7B5
- Validity: 2007-11-14 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 190472162 (0xb5a5fe2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 14 11:56:04 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Rheinische Fachhochschule Koeln gGmbH, OU = Rechenzentrum, CN = RFH Koeln CA, emailAddress = pki@rfh-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                31:23:31:B6:4D:35:FF:61:8A:F2:4D:5C:0F:89:9F:2F:4B:76:6B:46
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rfh-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1A130DCBA58D0A62C52942E71EAA29B4E340EE67B15C73342C7208304BE817CE
    SPKI SHA256: 42F308D543414C1315E2CD1AF02257BE7C049024DCB3DDFBC289D22C1D80D7B5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RFH Koeln CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Koeln, organizationName=Rheinische Fachhochschule Koeln gGmbH, organizationalUnitName=Rechenzentrum, commonName=RFH Koeln CA, emailAddress=pki@rfh-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42496C4097A
- SHA-256: 554FF47C82250A595B6A5D0A176B8835CD876E735D8EFA73C5F207A535C28617
- SPKI SHA-256: 42F308D543414C1315E2CD1AF02257BE7C049024DCB3DDFBC289D22C1D80D7B5
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401519552890 (0x17a42496c4097a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Koeln, O = Rheinische Fachhochschule Koeln gGmbH, OU = Rechenzentrum, CN = RFH Koeln CA, emailAddress = pki@rfh-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                31:23:31:B6:4D:35:FF:61:8A:F2:4D:5C:0F:89:9F:2F:4B:76:6B:46
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rfh-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 554FF47C82250A595B6A5D0A176B8835CD876E735D8EFA73C5F207A535C28617
    SPKI SHA256: 42F308D543414C1315E2CD1AF02257BE7C049024DCB3DDFBC289D22C1D80D7B5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RHRK-CA - G02

- Subject: countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA - G02, emailAddress=ca@rhrk.uni-kl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A174335
- SHA-256: 51E6C1CD853C2A760F30B567FD42335453C5912A5CC29223F44A32ED8085368F
- SPKI SHA-256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
- Validity: 2007-03-14 to 2019-03-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169296693 (0xa174335)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 14 09:51:34 2007 GMT
            Not After : Mar 13 00:00:00 2019 GMT
        Subject: C = DE, O = Regionales Hochschulrechenzentrum Kaiserslautern, CN = RHRK-CA - G02, emailAddress = ca@rhrk.uni-kl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2F:DD:13:98:63:5C:0B:C3:6F:B8:ED:86:E0:03:27:C1:6F:BA:B6:02
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rhrk.uni-kl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 51E6C1CD853C2A760F30B567FD42335453C5912A5CC29223F44A32ED8085368F
    SPKI SHA256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RHRK-CA - G02

- Subject: countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA - G02, emailAddress=ca@rhrk.uni-kl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17999FDA57D7B2
- SHA-256: 3C9C803C03108A7B2B0E90BC79A684539EF5D9AC015873234D9BC54A456CD74E
- SPKI SHA-256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
- Validity: 2014-05-19 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6642836306384818 (0x17999fda57d7b2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 19 15:24:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Regionales Hochschulrechenzentrum Kaiserslautern, CN = RHRK-CA - G02, emailAddress = ca@rhrk.uni-kl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2F:DD:13:98:63:5C:0B:C3:6F:B8:ED:86:E0:03:27:C1:6F:BA:B6:02
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rhrk.uni-kl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C9C803C03108A7B2B0E90BC79A684539EF5D9AC015873234D9BC54A456CD74E
    SPKI SHA256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RHRK-CA Classic - G02

- Subject: countryName=DE, organizationName=Regionales Hochschulrechenzentrum Kaiserslautern, commonName=RHRK-CA Classic - G02, emailAddress=ca@rhrk.uni-kl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060FC2F1E5E
- SHA-256: AF07C0B1630D4AEB67EF2A7AA0B7C3292CB37A857B9AEB9ABEF77C63B827E830
- SPKI SHA-256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670686551646 (0x179060fc2f1e5e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:21 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Regionales Hochschulrechenzentrum Kaiserslautern, CN = RHRK-CA Classic - G02, emailAddress = ca@rhrk.uni-kl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2F:DD:13:98:63:5C:0B:C3:6F:B8:ED:86:E0:03:27:C1:6F:BA:B6:02
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rhrk.uni-kl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AF07C0B1630D4AEB67EF2A7AA0B7C3292CB37A857B9AEB9ABEF77C63B827E830
    SPKI SHA256: B0B1717B5DE111CC95E656B8A5859C9C811467B59972E885BACF6C7F38F497D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RKI Certification Authority

- Subject: countryName=DE, organizationName=Robert Koch-Institut, organizationalUnitName=RKI-PCA, commonName=RKI Certification Authority, emailAddress=certify@rki.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17906102061372
- SHA-256: D7B1C441BE3827156D767F4DF17572A47F7E87CD4D9F436D3D09F890A5688297
- SPKI SHA-256: 390B01F14DDCE6119B8D8776F01E7916114AD0D49C038EAC2EBBF831AEA3C5F2
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670784525170 (0x17906102061372)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:26 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Robert Koch-Institut, OU = RKI-PCA, CN = RKI Certification Authority, emailAddress = certify@rki.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:67:AC:6B:A0:DD:BC:65:1E:0D:DE:39:B3:79:D1:5D:A7:31:8E:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:certify@rki.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7B1C441BE3827156D767F4DF17572A47F7E87CD4D9F436D3D09F890A5688297
    SPKI SHA256: 390B01F14DDCE6119B8D8776F01E7916114AD0D49C038EAC2EBBF831AEA3C5F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RKI Certification Authority

- Subject: countryName=DE, organizationName=Robert Koch-Institut, organizationalUnitName=RKI-PCA, commonName=RKI Certification Authority, emailAddress=certify@rki.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A1F468C
- SHA-256: FD34B0EF076BFF08CE7D62A11BAA032F776E842A0290EF12603936B0667A429B
- SPKI SHA-256: 390B01F14DDCE6119B8D8776F01E7916114AD0D49C038EAC2EBBF831AEA3C5F2
- Validity: 2007-03-20 to 2019-03-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169821836 (0xa1f468c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 20 11:43:57 2007 GMT
            Not After : Mar 19 00:00:00 2019 GMT
        Subject: C = DE, O = Robert Koch-Institut, OU = RKI-PCA, CN = RKI Certification Authority, emailAddress = certify@rki.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:67:AC:6B:A0:DD:BC:65:1E:0D:DE:39:B3:79:D1:5D:A7:31:8E:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:certify@rki.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FD34B0EF076BFF08CE7D62A11BAA032F776E842A0290EF12603936B0667A429B
    SPKI SHA256: 390B01F14DDCE6119B8D8776F01E7916114AD0D49C038EAC2EBBF831AEA3C5F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RUB-Chipcard CA

- Subject: countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA, emailAddress=rub-chipcardca@uv.ruhr-uni-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1A6408FAF6181D
- SHA-256: B7203AD0F4A8564C44B01A68EA08AB030D8CBDD550887AC3D904DAC051E86F3B
- SPKI SHA-256: C7B478E4CC17C14BEEF5E518E5BFEFD59B48755FD9E3FBC9E15C0C231D51D1F4
- Validity: 2015-11-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7428339127425053 (0x1a6408faf6181d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 12 12:51:54 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Ruhr-Universitaet Bochum, CN = RUB-Chipcard CA, emailAddress = rub-chipcardca@uv.ruhr-uni-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                D0:96:E3:82:5D:32:27:49:96:2E:E1:9E:52:EB:B7:6E:AC:1D:19:63
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rub-chipcardca@uv.ruhr-uni-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B7203AD0F4A8564C44B01A68EA08AB030D8CBDD550887AC3D904DAC051E86F3B
    SPKI SHA256: C7B478E4CC17C14BEEF5E518E5BFEFD59B48755FD9E3FBC9E15C0C231D51D1F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RUB-Chipcard CA

- Subject: countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA, emailAddress=rub-chipcardca@uv.ruhr-uni-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DC21597
- SHA-256: 6FC5B7726D2ED7B7FD7F3E1DC2ECFD5866966B087B4BE50AB5381529371C17BE
- SPKI SHA-256: C7B478E4CC17C14BEEF5E518E5BFEFD59B48755FD9E3FBC9E15C0C231D51D1F4
- Validity: 2009-02-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 230823319 (0xdc21597)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 23 12:35:20 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Ruhr-Universitaet Bochum, CN = RUB-Chipcard CA, emailAddress = rub-chipcardca@uv.ruhr-uni-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D0:96:E3:82:5D:32:27:49:96:2E:E1:9E:52:EB:B7:6E:AC:1D:19:63
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rub-chipcardca@uv.ruhr-uni-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6FC5B7726D2ED7B7FD7F3E1DC2ECFD5866966B087B4BE50AB5381529371C17BE
    SPKI SHA256: C7B478E4CC17C14BEEF5E518E5BFEFD59B48755FD9E3FBC9E15C0C231D51D1F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RUB-Chipcard CA G2

- Subject: countryName=DE, organizationName=Ruhr-Universitaet Bochum, commonName=RUB-Chipcard CA G2
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B9DCDA0A1BB20DCD658CFFF
- SHA-256: 709BE4EAB0A3721236F28B2AB80F76FDA251330B3282F515EA5E0B6C79AE6729
- SPKI SHA-256: D4B86B2DDDAFDFC10FD612C3A45E9584DA8C8F2471BBD7116992F4AFDF2BD38A
- Validity: 2016-07-07 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/ruhr-uni-bochum-chipcard-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:9d:cd:a0:a1:bb:20:dc:d6:58:cf:ff
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Jul  7 12:50:24 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, O = Ruhr-Universitaet Bochum, CN = RUB-Chipcard CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                E9:D7:27:A3:2C:A5:C6:A1:93:67:CD:3A:D5:50:76:48:34:C2:C0:66
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 709BE4EAB0A3721236F28B2AB80F76FDA251330B3282F515EA5E0B6C79AE6729
    SPKI SHA256: D4B86B2DDDAFDFC10FD612C3A45E9584DA8C8F2471BBD7116992F4AFDF2BD38A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ruhr-Universitaet Bochum CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Ruhr-Universitaet Bochum, commonName=Ruhr-Universitaet Bochum CA, emailAddress=rubca@ruhr-uni-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42475B5CAF8
- SHA-256: 82BD2280E6F70E5BAACA0F2D0DE3ADA511C8BFDD9EDDD8E6ABF94C808C2C7A63
- SPKI SHA-256: 24099983205A37FC82B82E8BE8E2ABAAA9C0500CAEC322DCCF02201672A3C7A0
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400964971256 (0x17a42475b5caf8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:25 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Ruhr-Universitaet Bochum, CN = Ruhr-Universitaet Bochum CA, emailAddress = rubca@ruhr-uni-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BB:29:B8:3B:5F:04:24:E3:8B:70:7B:60:7F:36:6F:17:61:CB:AE:92
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rubca@ruhr-uni-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 82BD2280E6F70E5BAACA0F2D0DE3ADA511C8BFDD9EDDD8E6ABF94C808C2C7A63
    SPKI SHA256: 24099983205A37FC82B82E8BE8E2ABAAA9C0500CAEC322DCCF02201672A3C7A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ruhr-Universitaet Bochum CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Ruhr-Universitaet Bochum, commonName=Ruhr-Universitaet Bochum CA, emailAddress=rubca@ruhr-uni-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A7D0B8E
- SHA-256: A791C713EA1D98E5AE23B3FDC62BB6013F1C613A9404EC5B51C7CE0922DAF775
- SPKI SHA-256: 24099983205A37FC82B82E8BE8E2ABAAA9C0500CAEC322DCCF02201672A3C7A0
- Validity: 2007-05-30 to 2019-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 175967118 (0xa7d0b8e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 30 14:45:20 2007 GMT
            Not After : May 29 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Ruhr-Universitaet Bochum, CN = Ruhr-Universitaet Bochum CA, emailAddress = rubca@ruhr-uni-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BB:29:B8:3B:5F:04:24:E3:8B:70:7B:60:7F:36:6F:17:61:CB:AE:92
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rubca@ruhr-uni-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A791C713EA1D98E5AE23B3FDC62BB6013F1C613A9404EC5B51C7CE0922DAF775
    SPKI SHA256: 24099983205A37FC82B82E8BE8E2ABAAA9C0500CAEC322DCCF02201672A3C7A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RUM-CA Zertifizierungsinstanz

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AA2FB08
- SHA-256: 7D62448301474FC533007BCA01C58208698F2375A594DEC35F2D31B7D3441DD6
- SPKI SHA-256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
- Validity: 2007-06-28 to 2019-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 178453256 (0xaa2fb08)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 28 09:20:58 2007 GMT
            Not After : Jun 27 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Universitaet Mannheim, OU = Rechenzentrum, CN = RUM-CA Zertifizierungsinstanz, emailAddress = rum-ca@rz.uni-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                59:20:29:40:42:D6:FE:8E:07:2E:BA:3D:87:4F:32:AD:64:76:8E:0C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rum-ca@rz.uni-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7D62448301474FC533007BCA01C58208698F2375A594DEC35F2D31B7D3441DD6
    SPKI SHA256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RUM-CA-G Zertifizierungsinstanz

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA-G Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AAC6F4A
- SHA-256: 10AB14FF9EA6C6BEFB6B9ACC001213D8972B51C465350E5E6562EB223E16480E
- SPKI SHA-256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
- Validity: 2007-07-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179072842 (0xaac6f4a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  5 13:27:24 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Universitaet Mannheim, OU = Rechenzentrum, CN = RUM-CA-G Zertifizierungsinstanz, emailAddress = rum-ca@rz.uni-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                59:20:29:40:42:D6:FE:8E:07:2E:BA:3D:87:4F:32:AD:64:76:8E:0C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rum-ca@rz.uni-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 10AB14FF9EA6C6BEFB6B9ACC001213D8972B51C465350E5E6562EB223E16480E
    SPKI SHA256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RUM-CA-G Zertifizierungsinstanz

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Mannheim, organizationName=Universitaet Mannheim, organizationalUnitName=Rechenzentrum, commonName=RUM-CA-G Zertifizierungsinstanz, emailAddress=rum-ca@rz.uni-mannheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4253C7F3744
- SHA-256: 98233B9DCADC30A0A0FD89EA514CC6D737651D52DF828996E94A314C7715DC2B
- SPKI SHA-256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404300060484 (0x17a4253c7f3744)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Mannheim, O = Universitaet Mannheim, OU = Rechenzentrum, CN = RUM-CA-G Zertifizierungsinstanz, emailAddress = rum-ca@rz.uni-mannheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                59:20:29:40:42:D6:FE:8E:07:2E:BA:3D:87:4F:32:AD:64:76:8E:0C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rum-ca@rz.uni-mannheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98233B9DCADC30A0A0FD89EA514CC6D737651D52DF828996E94A314C7715DC2B
    SPKI SHA256: 6E8072F8D6606CF73246B367DA508435985C913BFDB688F1DDA2330E37A6331F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RWI - TD-EDV CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Essen, organizationName=Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., organizationalUnitName=RWI-TD-EDV, commonName=RWI - TD-EDV CA, emailAddress=ca@rwi-essen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6EE422388
- SHA-256: 07803C7CB59DD2F4DC692D06E3E59C84DF2907BF398BF6266B544B5E5A3C3B58
- SPKI SHA-256: F62DA3D4BE9740B4FECF0D7EA8BFA07A37A5110564F731567B4FC906DABC25DB
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399558472584 (0x17aff6ee422388)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:22 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Essen, O = Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., OU = RWI-TD-EDV, CN = RWI - TD-EDV CA, emailAddress = ca@rwi-essen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2C:72:1D:2B:12:61:96:09:5D:54:F2:20:C4:67:E4:5D:F9:93:CF:F2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rwi-essen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 07803C7CB59DD2F4DC692D06E3E59C84DF2907BF398BF6266B544B5E5A3C3B58
    SPKI SHA256: F62DA3D4BE9740B4FECF0D7EA8BFA07A37A5110564F731567B4FC906DABC25DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RWI - TD-EDV CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Essen, organizationName=Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., organizationalUnitName=RWI-TD-EDV, commonName=RWI - TD-EDV CA, emailAddress=ca@rwi-essen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 116B5309
- SHA-256: 0CB09A9F8E0949E68A19FFB46EAEC7CF3669113FC57A2B4CA58AB479E2E9BC2A
- SPKI SHA-256: F62DA3D4BE9740B4FECF0D7EA8BFA07A37A5110564F731567B4FC906DABC25DB
- Validity: 2011-02-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 292246281 (0x116b5309)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  4 10:31:22 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Essen, O = Rheinisch-Westfaelisches Institut fuer Wirtschaftsforschung e.V., OU = RWI-TD-EDV, CN = RWI - TD-EDV CA, emailAddress = ca@rwi-essen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2C:72:1D:2B:12:61:96:09:5D:54:F2:20:C4:67:E4:5D:F9:93:CF:F2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rwi-essen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0CB09A9F8E0949E68A19FFB46EAEC7CF3669113FC57A2B4CA58AB479E2E9BC2A
    SPKI SHA256: F62DA3D4BE9740B4FECF0D7EA8BFA07A37A5110564F731567B4FC906DABC25DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### RWTH Aachen CA

- Subject: countryName=DE, organizationName=RWTH Aachen, commonName=RWTH Aachen CA, emailAddress=ca@rwth-aachen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E1CC0093
- SHA-256: 9C62D2766501BF0487C4D02B2077C1360E2E72B86336999B46A37DC4D4A05AFC
- SPKI SHA-256: EFF836FD7A53CA6F926DB89FB0411DEF76F7B7AFEF893B9ACA67315DED5177D4
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670243848339 (0x179060e1cc0093)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = RWTH Aachen, CN = RWTH Aachen CA, emailAddress = ca@rwth-aachen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6E:D5:3E:C0:1C:2F:71:C9:3C:BF:49:4E:EF:6A:55:48:EC:D1:F2:38
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rwth-aachen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9C62D2766501BF0487C4D02B2077C1360E2E72B86336999B46A37DC4D4A05AFC
    SPKI SHA256: EFF836FD7A53CA6F926DB89FB0411DEF76F7B7AFEF893B9ACA67315DED5177D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RWTH Aachen CA

- Subject: countryName=DE, organizationName=RWTH Aachen, commonName=RWTH Aachen CA, emailAddress=ca@rwth-aachen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F274E0
- SHA-256: 449E107662C29610C74C6EC395CBFD095FC3E65D8AA79F816071155E7F4B967A
- SPKI SHA-256: EFF836FD7A53CA6F926DB89FB0411DEF76F7B7AFEF893B9ACA67315DED5177D4
- Validity: 2007-02-14 to 2019-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166884576 (0x9f274e0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 14 11:49:38 2007 GMT
            Not After : Feb 13 00:00:00 2019 GMT
        Subject: C = DE, O = RWTH Aachen, CN = RWTH Aachen CA, emailAddress = ca@rwth-aachen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6E:D5:3E:C0:1C:2F:71:C9:3C:BF:49:4E:EF:6A:55:48:EC:D1:F2:38
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rwth-aachen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 449E107662C29610C74C6EC395CBFD095FC3E65D8AA79F816071155E7F4B967A
    SPKI SHA256: EFF836FD7A53CA6F926DB89FB0411DEF76F7B7AFEF893B9ACA67315DED5177D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Sachsen Global CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Freistaat Sachsen, organizationalUnitName=Saechsisches Staatsministerium des Innern, commonName=Sachsen Global CA, emailAddress=pki@smi.sachsen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E852875
- SHA-256: C3C11512435D162C27E8EE871674904CC642C36093519C761DC8B99B403D31C9
- SPKI SHA-256: B4045BB9479EBC44D0267B5C57201463DF960E846EAE6E2BED8F11CEC5952424
- Validity: 2009-07-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 243607669 (0xe852875)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 21 11:47:49 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Freistaat Sachsen, OU = Saechsisches Staatsministerium des Innern, CN = Sachsen Global CA, emailAddress = pki@smi.sachsen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CD:CE:FE:B1:FF:F9:2E:E4:96:A9:FF:2B:E3:2D:80:1D:8E:4A:98:F5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@smi.sachsen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C3C11512435D162C27E8EE871674904CC642C36093519C761DC8B99B403D31C9
    SPKI SHA256: B4045BB9479EBC44D0267B5C57201463DF960E846EAE6E2BED8F11CEC5952424
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Sachsen Global CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Freistaat Sachsen, organizationalUnitName=Saechsisches Staatsministerium des Innern, commonName=Sachsen Global CA, emailAddress=pki@smi.sachsen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B9A84C38
- SHA-256: 7408B90FD2F0FE62C3C5E6BB2A8E23DCF27CA60F7F35D4B047F386396169CD61
- SPKI SHA-256: B4045BB9479EBC44D0267B5C57201463DF960E846EAE6E2BED8F11CEC5952424
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398675975224 (0x17aff6b9a84c38)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Freistaat Sachsen, OU = Saechsisches Staatsministerium des Innern, CN = Sachsen Global CA, emailAddress = pki@smi.sachsen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CD:CE:FE:B1:FF:F9:2E:E4:96:A9:FF:2B:E3:2D:80:1D:8E:4A:98:F5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@smi.sachsen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7408B90FD2F0FE62C3C5E6BB2A8E23DCF27CA60F7F35D4B047F386396169CD61
    SPKI SHA256: B4045BB9479EBC44D0267B5C57201463DF960E846EAE6E2BED8F11CEC5952424
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### San-Netz CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Sanitaetsakademie der Bundeswehr Muenchen, commonName=San-Netz CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1840DC161EACFA
- SHA-256: 0F1F0B8D7A31E2A33F3656E090561E9945746D244FA714BFFE7DF1D4B4184F82
- SPKI SHA-256: 4FD7E807D4472B8F8899872D8EC2FC2D3EDEEA4C29087B7ACB91C91E42B9635B
- Validity: 2014-09-23 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6826713449147642 (0x1840dc161eacfa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 23 11:50:30 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Sanitaetsakademie der Bundeswehr Muenchen, CN = San-Netz CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                39:F1:08:28:35:D9:B3:25:C5:B7:11:5D:E1:DD:8A:75:71:DE:FE:BC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F1F0B8D7A31E2A33F3656E090561E9945746D244FA714BFFE7DF1D4B4184F82
    SPKI SHA256: 4FD7E807D4472B8F8899872D8EC2FC2D3EDEEA4C29087B7ACB91C91E42B9635B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Schloss Dagstuhl - LZI GmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Saarland, localityName=Wadern, organizationName=Schloss Dagstuhl - LZI GmbH, organizationalUnitName=IT-Abteilung, commonName=Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress=pki@dagstuhl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D986142B
- SHA-256: C6E0461A083D5BDD597F4FD3C93C712BE924C70476449D67301797D44AFA358A
- SPKI SHA-256: CEC3D4A666FF40B64674529F180FA4A1F49D3CA45D2E63CD62624BC168B1A0E6
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399210603563 (0x17aff6d986142b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:01 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Saarland, L = Wadern, O = Schloss Dagstuhl - LZI GmbH, OU = IT-Abteilung, CN = Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress = pki@dagstuhl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CA:90:2B:00:3D:97:AF:1F:EC:C1:09:6E:F4:CF:7B:DF:D1:E6:70:AD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dagstuhl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C6E0461A083D5BDD597F4FD3C93C712BE924C70476449D67301797D44AFA358A
    SPKI SHA256: CEC3D4A666FF40B64674529F180FA4A1F49D3CA45D2E63CD62624BC168B1A0E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Schloss Dagstuhl - LZI GmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Saarland, localityName=Wadern, organizationName=Schloss Dagstuhl - LZI GmbH, organizationalUnitName=IT-Abteilung, commonName=Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress=pki@dagstuhl.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10076670
- SHA-256: FC57076D51D594E30AD25776FF5CB86E0B7398226DBCE531691D5F91FF604A8B
- SPKI SHA-256: CEC3D4A666FF40B64674529F180FA4A1F49D3CA45D2E63CD62624BC168B1A0E6
- Validity: 2010-05-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 268920432 (0x10076670)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 10 11:07:12 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Saarland, L = Wadern, O = Schloss Dagstuhl - LZI GmbH, OU = IT-Abteilung, CN = Schloss Dagstuhl - LZI GmbH CA - G01, emailAddress = pki@dagstuhl.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CA:90:2B:00:3D:97:AF:1F:EC:C1:09:6E:F4:CF:7B:DF:D1:E6:70:AD
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@dagstuhl.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FC57076D51D594E30AD25776FF5CB86E0B7398226DBCE531691D5F91FF604A8B
    SPKI SHA256: CEC3D4A666FF40B64674529F180FA4A1F49D3CA45D2E63CD62624BC168B1A0E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Senatsverwaltung-Berlin-Schul-CA - G02

- Subject: countryName=DE, organizationName=Land Berlin, organizationalUnitName=Senatsverwaltung, commonName=Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress=pki@schule.berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6F142CBE4
- SHA-256: BB745D49D9059F31D8A9E14E476C8B9FF95C4B366C285E32092697B8F918307C
- SPKI SHA-256: 626CFA1B627E492D010615F81D6F14E3745A2FA401EE732584975743E37D9287
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399608847332 (0x17aff6f142cbe4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:25 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Land Berlin, OU = Senatsverwaltung, CN = Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress = pki@schule.berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F4:D5:9A:BF:8D:CD:D4:82:D1:89:39:B8:ED:BA:1E:05:B2:4D:DD:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@schule.berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB745D49D9059F31D8A9E14E476C8B9FF95C4B366C285E32092697B8F918307C
    SPKI SHA256: 626CFA1B627E492D010615F81D6F14E3745A2FA401EE732584975743E37D9287
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Senatsverwaltung-Berlin-Schul-CA - G02

- Subject: countryName=DE, organizationName=Land Berlin, organizationalUnitName=Senatsverwaltung, commonName=Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress=pki@schule.berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 11B502CD
- SHA-256: DC73AC8C2032248EFDA2D73D51514AD6648147D423D1C6CD1B4B98F3C270594A
- SPKI SHA-256: 626CFA1B627E492D010615F81D6F14E3745A2FA401EE732584975743E37D9287
- Validity: 2011-04-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 297075405 (0x11b502cd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  1 07:56:45 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Land Berlin, OU = Senatsverwaltung, CN = Senatsverwaltung-Berlin-Schul-CA - G02, emailAddress = pki@schule.berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F4:D5:9A:BF:8D:CD:D4:82:D1:89:39:B8:ED:BA:1E:05:B2:4D:DD:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@schule.berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DC73AC8C2032248EFDA2D73D51514AD6648147D423D1C6CD1B4B98F3C270594A
    SPKI SHA256: 626CFA1B627E492D010615F81D6F14E3745A2FA401EE732584975743E37D9287
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Shared Business CA 2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=Shared Business CA 2
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 0114
- SHA-256: AC44657DB28C26F38C61D5E417FCFC2961F28BFD94A2C1817D64F2ED43E3AAB2
- SPKI SHA-256: C0BCE808B6DF059924EA91AB70DBBF21AE97B862FFDD51E14CB8F1D63593515A
- Validity: 2010-07-14 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://sbca.telesec.de/sbca/download/cp.pdf, http://sbca.telesec.de/sbca/download/cp.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://sbca.telesec.de/sbca/download/download.crl?path=CN%3DDeutsche%20Telekom%20Root%20CA%202%2COU%3DT-TeleSec%20Trust%20Center%2CO%3DDeutsche%20Telekom%20AG%2CC%3DDE%3FAuthorityRevocationList, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 276 (0x114)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jul 14 10:35:19 2010 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = Trust Center Deutsche Telekom, CN = Shared Business CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B2:86:FE:2D:87:D4:F8:62:5D:55:94:07:3B:82:C9:00:55:E8:A8:45
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.25
                  CPS: http://sbca.telesec.de/sbca/download/cp.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://sbca.telesec.de/sbca/download/download.crl?path=CN%3DDeutsche%20Telekom%20Root%20CA%202%2COU%3DT-TeleSec%20Trust%20Center%2CO%3DDeutsche%20Telekom%20AG%2CC%3DDE%3FAuthorityRevocationList
                Full Name:
                  URI:ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AC44657DB28C26F38C61D5E417FCFC2961F28BFD94A2C1817D64F2ED43E3AAB2
    SPKI SHA256: C0BCE808B6DF059924EA91AB70DBBF21AE97B862FFDD51E14CB8F1D63593515A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://sbca.telesec.de/sbca/download/download.crl?path=CN%3DDeutsche%20Telekom%20Root%20CA%202%2COU%3DT-TeleSec%20Trust%20Center%2CO%3DDeutsche%20Telekom%20AG%2CC%3DDE%3FAuthorityRevocationList, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Shared Business CA 3

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=Shared Business CA 3
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 03810F39E00CB4
- SHA-256: D8022A38FD51AAA4F79E2E95225B5B8ACC71A8289ED7917997AE701540888D96
- SPKI SHA-256: CDB3F3CCB1F969A035338699230C18F8317AE1A6CE4890300F6F7C6849AFED40
- Validity: 2012-09-04 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/en/sbca-en/support/cps, https://www.telesec.de/en/sbca-en/support/cps
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- CRL DP: http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 986327325609140 (0x3810f39e00cb4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Sep  4 11:27:19 2012 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = Shared Business CA 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                92:01:43:40:B5:D8:A1:14:8B:DA:FB:D9:F1:20:9F:58:08:C2:7A:D3
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.25
                  CPS: http://sbca.telesec.de/download/cps.pdf
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp02.telesec.de/ocspr
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D8022A38FD51AAA4F79E2E95225B5B8ACC71A8289ED7917997AE701540888D96
    SPKI SHA256: CDB3F3CCB1F969A035338699230C18F8317AE1A6CE4890300F6F7C6849AFED40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### Shared Business CA 4

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=Shared Business CA 4
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 30158B58CD5631F5
- SHA-256: 5C7D5957F556461542B65B2DB6D59FEA1AE0327DD818143A2E2C216D07154422
- SPKI SHA-256: 1115AA9B599E8F911EB3F68CD8171FF97A5AF8FD7546E620092658FCE683D161
- Validity: 2014-02-11 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/en/sbca-en/support/cps, https://www.telesec.de/en/sbca-en/support/cps
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- CRL DP: http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3464828701849825781 (0x30158b58cd5631f5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Feb 11 13:29:02 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, ST = Nordrhein Westfalen, postalCode = 57250, L = Netphen, street = Untere Industriestr. 20, CN = Shared Business CA 4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:FF:6F:D1:12:6F:57:CA:D2:D8:D8:C1:BE:F6:13:34:22:74:81:33
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.25
                  CPS: http://sbca.telesec.de/cps/cps.pdf
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp02.telesec.de/ocspr
                CA Issuers - URI:http://crl.sbca.telesec.de/crt/DT_ROOT_CA_2.cer
                CA Issuers - URI:ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5C7D5957F556461542B65B2DB6D59FEA1AE0327DD818143A2E2C216D07154422
    SPKI SHA256: 1115AA9B599E8F911EB3F68CD8171FF97A5AF8FD7546E620092658FCE683D161
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- AIA CA Issuers: http://crl.sbca.telesec.de/crt/DT_ROOT_CA_2.cer, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://crl.sbca.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.sbca.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SRH Hochschule Heidelberg CA-G01

- Subject: countryName=DE, organizationName=SRH Hochschule Heidelberg der SRH Hochschulen GmbH, commonName=SRH Hochschule Heidelberg CA-G01, emailAddress=ca@fh-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6EB8E61E9
- SHA-256: 6AF7443CF8D07985B0B0E2C72844F5EC8768850B5698732411566AD8800D6C2F
- SPKI SHA-256: F66646A07B043CF83D544B7A3F547A0B7F9FE1C7C8526C9539065C8AE60020C3
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399513137641 (0x17aff6eb8e61e9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:20 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = SRH Hochschule Heidelberg der SRH Hochschulen GmbH, CN = SRH Hochschule Heidelberg CA-G01, emailAddress = ca@fh-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D0:CB:80:6D:04:80:85:FD:19:8C:79:E3:9F:21:06:3B:3B:3B:8D:2A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6AF7443CF8D07985B0B0E2C72844F5EC8768850B5698732411566AD8800D6C2F
    SPKI SHA256: F66646A07B043CF83D544B7A3F547A0B7F9FE1C7C8526C9539065C8AE60020C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SRH Hochschule Heidelberg CA-G01

- Subject: countryName=DE, organizationName=SRH Hochschule Heidelberg der SRH Hochschulen GmbH, commonName=SRH Hochschule Heidelberg CA-G01, emailAddress=ca@fh-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1160E179
- SHA-256: 020A1CBA47AE5D759F22579EA4E07AB489CC3E4E94B4E28C88E7A5DCCC53BABA
- SPKI SHA-256: F66646A07B043CF83D544B7A3F547A0B7F9FE1C7C8526C9539065C8AE60020C3
- Validity: 2011-01-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 291561849 (0x1160e179)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 27 12:24:09 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = SRH Hochschule Heidelberg der SRH Hochschulen GmbH, CN = SRH Hochschule Heidelberg CA-G01, emailAddress = ca@fh-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D0:CB:80:6D:04:80:85:FD:19:8C:79:E3:9F:21:06:3B:3B:3B:8D:2A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@fh-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 020A1CBA47AE5D759F22579EA4E07AB489CC3E4E94B4E28C88E7A5DCCC53BABA
    SPKI SHA256: F66646A07B043CF83D544B7A3F547A0B7F9FE1C7C8526C9539065C8AE60020C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### STIFTUNG PREUSSISCHER KULTURBESITZ - CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=STIFTUNG PREUSSISCHER KULTURBESITZ, commonName=STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress=ca@hv.spk-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6952C6C2D
- SHA-256: 73A0394164975FB5A119A46DE0692874D811AC95D307DDD0614F0AF73D22D3CC
- SPKI SHA-256: 29059F408FD107BB0B3C5DB19B957B293218F6030776095164AC52C1E8B45B8A
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398063877165 (0x17aff6952c6c2d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:53 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = STIFTUNG PREUSSISCHER KULTURBESITZ, CN = STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress = ca@hv.spk-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E7:A7:C8:65:27:05:BF:0A:63:48:44:19:47:D9:CA:B8:E0:E5:50:29
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hv.spk-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 73A0394164975FB5A119A46DE0692874D811AC95D307DDD0614F0AF73D22D3CC
    SPKI SHA256: 29059F408FD107BB0B3C5DB19B957B293218F6030776095164AC52C1E8B45B8A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### STIFTUNG PREUSSISCHER KULTURBESITZ - CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=STIFTUNG PREUSSISCHER KULTURBESITZ, commonName=STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress=ca@hv.spk-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CE0748F
- SHA-256: C889518FB1D398CB84A9A8630272E9ECA0FB070E1A796C8FBBE9039DC5AB9768
- SPKI SHA-256: 29059F408FD107BB0B3C5DB19B957B293218F6030776095164AC52C1E8B45B8A
- Validity: 2008-09-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 216036495 (0xce0748f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep  5 09:08:15 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = STIFTUNG PREUSSISCHER KULTURBESITZ, CN = STIFTUNG PREUSSISCHER KULTURBESITZ - CA, emailAddress = ca@hv.spk-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E7:A7:C8:65:27:05:BF:0A:63:48:44:19:47:D9:CA:B8:E0:E5:50:29
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@hv.spk-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C889518FB1D398CB84A9A8630272E9ECA0FB070E1A796C8FBBE9039DC5AB9768
    SPKI SHA256: 29059F408FD107BB0B3C5DB19B957B293218F6030776095164AC52C1E8B45B8A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### subito. Dokumente aus Bibliotheken e.V. CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=subito. Dokumente aus Bibliotheken e.V., organizationalUnitName=Business Office, commonName=subito. Dokumente aus Bibliotheken e.V. CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7087464CA
- SHA-256: B38ADEF1A8EA4FADE842909BFCE5851B631DBD18137114B4375504FF33CDE868
- SPKI SHA-256: 54F6C781A099979B52D105DC3D5FC51838CCD83FE0667FD867C4151EFA003ADF
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399997973706 (0x17aff7087464ca)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = subito. Dokumente aus Bibliotheken e.V., OU = Business Office, CN = subito. Dokumente aus Bibliotheken e.V. CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                47:B2:0F:DA:E1:08:EB:5E:80:02:4D:F5:E0:72:1A:2F:C2:1A:9D:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B38ADEF1A8EA4FADE842909BFCE5851B631DBD18137114B4375504FF33CDE868
    SPKI SHA256: 54F6C781A099979B52D105DC3D5FC51838CCD83FE0667FD867C4151EFA003ADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### subito. Dokumente aus Bibliotheken e.V. CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=subito. Dokumente aus Bibliotheken e.V., organizationalUnitName=Business Office, commonName=subito. Dokumente aus Bibliotheken e.V. CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 143B3E595E0292
- SHA-256: CE7C436588016B6050816D6B7A2CF6A9FB4D70C00297157824CA23022D2F0A08
- SPKI SHA-256: 54F6C781A099979B52D105DC3D5FC51838CCD83FE0667FD867C4151EFA003ADF
- Validity: 2012-08-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5694638507557522 (0x143b3e595e0292)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  3 12:15:06 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = subito. Dokumente aus Bibliotheken e.V., OU = Business Office, CN = subito. Dokumente aus Bibliotheken e.V. CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                47:B2:0F:DA:E1:08:EB:5E:80:02:4D:F5:E0:72:1A:2F:C2:1A:9D:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CE7C436588016B6050816D6B7A2CF6A9FB4D70C00297157824CA23022D2F0A08
    SPKI SHA256: 54F6C781A099979B52D105DC3D5FC51838CCD83FE0667FD867C4151EFA003ADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### T-Systems International GmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=T-Systems International GmbH, organizationalUnitName=ICTS, commonName=T-Systems International GmbH CA - G01, emailAddress=pki@atriumberlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6D4EA127E
- SHA-256: 9D9EE62522C0586EB53F9192650C4A989FFB6F4E5B06C35800CC7ADD0C2B2860
- SPKI SHA-256: 3F70C5DB4017D89602D378FF78B8D623D721E1682034BF3502FED37F8C116D32
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399133270654 (0x17aff6d4ea127e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = T-Systems International GmbH, OU = ICTS, CN = T-Systems International GmbH CA - G01, emailAddress = pki@atriumberlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:3E:0B:6E:FC:8A:A1:BD:88:D0:8D:AF:90:F4:2B:29:E5:CB:AE:52
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@atriumberlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D9EE62522C0586EB53F9192650C4A989FFB6F4E5B06C35800CC7ADD0C2B2860
    SPKI SHA256: 3F70C5DB4017D89602D378FF78B8D623D721E1682034BF3502FED37F8C116D32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### T-Systems International GmbH CA - G01

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=T-Systems International GmbH, organizationalUnitName=ICTS, commonName=T-Systems International GmbH CA - G01, emailAddress=pki@atriumberlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0FB5F6E7
- SHA-256: 85EE4B00202B37D9F19C01A59DDE4429985285CDE325154375A7965834F30FE9
- SPKI SHA-256: 3F70C5DB4017D89602D378FF78B8D623D721E1682034BF3502FED37F8C116D32
- Validity: 2010-03-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 263583463 (0xfb5f6e7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  9 16:37:44 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = T-Systems International GmbH, OU = ICTS, CN = T-Systems International GmbH CA - G01, emailAddress = pki@atriumberlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:3E:0B:6E:FC:8A:A1:BD:88:D0:8D:AF:90:F4:2B:29:E5:CB:AE:52
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@atriumberlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 85EE4B00202B37D9F19C01A59DDE4429985285CDE325154375A7965834F30FE9
    SPKI SHA256: 3F70C5DB4017D89602D378FF78B8D623D721E1682034BF3502FED37F8C116D32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### T-Systems SfR CA

- Subject: countryName=DE, organizationName=T-Systems SfR, commonName=T-Systems SfR CA, emailAddress=ca@t-systems-sfr.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09C2FDAD
- SHA-256: D27751CB21BBB5D676351965748FA45BF2583422E79B8556469BCC7874007A49
- SPKI SHA-256: 4632324106C44482246CA5916F50A997FAC3A3B1198BE979423114FE7BD73E3B
- Validity: 2007-01-09 to 2018-11-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163773869 (0x9c2fdad)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  9 11:44:31 2007 GMT
            Not After : Nov 30 22:00:00 2018 GMT
        Subject: C = DE, O = T-Systems SfR, CN = T-Systems SfR CA, emailAddress = ca@t-systems-sfr.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                83:67:D5:77:CF:08:21:C6:1A:4E:DC:00:97:AF:CB:45:1E:F9:D4:44
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@t-systems-sfr.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D27751CB21BBB5D676351965748FA45BF2583422E79B8556469BCC7874007A49
    SPKI SHA256: 4632324106C44482246CA5916F50A997FAC3A3B1198BE979423114FE7BD73E3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### T-Systems SfR CA

- Subject: countryName=DE, organizationName=T-Systems SfR, commonName=T-Systems SfR CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09C1C2FE
- SHA-256: 22FB9353A119A3CC4C9C1574D7BDAE62E35BF723C76EB4B9AB4E38A11BF31549
- SPKI SHA-256: 4632324106C44482246CA5916F50A997FAC3A3B1198BE979423114FE7BD73E3B
- Validity: 2007-01-08 to 2018-11-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163693310 (0x9c1c2fe)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan  8 13:21:51 2007 GMT
            Not After : Nov 30 22:00:00 2018 GMT
        Subject: C = DE, O = T-Systems SfR, CN = T-Systems SfR CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                83:67:D5:77:CF:08:21:C6:1A:4E:DC:00:97:AF:CB:45:1E:F9:D4:44
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@t-systems-sfr.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 22FB9353A119A3CC4C9C1574D7BDAE62E35BF723C76EB4B9AB4E38A11BF31549
    SPKI SHA256: 4632324106C44482246CA5916F50A997FAC3A3B1198BE979423114FE7BD73E3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### T-Systems SfR CA 2

- Subject: countryName=DE, organizationName=T-Systems SfR GmbH, commonName=T-Systems SfR CA 2, emailAddress=ca@t-systems-sfr.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0D12AD56
- SHA-256: 52663BD4C2739E7026147A27FC5186D25AB3CBC21FA8801BD810C07D272240E6
- SPKI SHA-256: 23F7428487BCF8BFEDB4523F652BB209E51022A952DC02FB08295F3428DA67C4
- Validity: 2008-10-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 219327830 (0xd12ad56)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 13 11:23:50 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = T-Systems SfR GmbH, CN = T-Systems SfR CA 2, emailAddress = ca@t-systems-sfr.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AE:00:A6:A9:BE:D5:3A:B7:DC:97:54:E8:90:16:2D:6F:F4:25:AD:A3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@t-systems-sfr.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 52663BD4C2739E7026147A27FC5186D25AB3CBC21FA8801BD810C07D272240E6
    SPKI SHA256: 23F7428487BCF8BFEDB4523F652BB209E51022A952DC02FB08295F3428DA67C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### T-Systems SfR CA 2

- Subject: countryName=DE, organizationName=T-Systems SfR GmbH, commonName=T-Systems SfR CA 2, emailAddress=ca@t-systems-sfr.com
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69BE8C8F6
- SHA-256: F1667DC9B2510D5F3744D901B84369AFA0A55A24D73CA0B3DAF42AEE2F61798E
- SPKI SHA-256: 23F7428487BCF8BFEDB4523F652BB209E51022A952DC02FB08295F3428DA67C4
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398176884982 (0x17aff69be8c8f6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:00 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems SfR GmbH, CN = T-Systems SfR CA 2, emailAddress = ca@t-systems-sfr.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AE:00:A6:A9:BE:D5:3A:B7:DC:97:54:E8:90:16:2D:6F:F4:25:AD:A3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@t-systems-sfr.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1667DC9B2510D5F3744D901B84369AFA0A55A24D73CA0B3DAF42AEE2F61798E
    SPKI SHA256: 23F7428487BCF8BFEDB4523F652BB209E51022A952DC02FB08295F3428DA67C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### T-Systems SI CA

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=Systems Integration Region 1 Standort Berlin, commonName=T-Systems SI CA, emailAddress=pki@atriumberlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424771736B1
- SHA-256: 97590CD4177CE6860EA7138F493B63CA03823720A8070BE5F0C81CDA6EF97061
- SPKI SHA-256: 8F46FBFC161F9B8A5E3B9CAD70AE3A4A0280B85167A6FAF409CA74F2CDC1846A
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654400988133041 (0x17a424771736b1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:27 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = Systems Integration Region 1 Standort Berlin, CN = T-Systems SI CA, emailAddress = pki@atriumberlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:4D:D9:D3:94:AF:3E:B2:C4:78:E6:05:46:DC:17:88:60:A1:DB:6D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@atriumberlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 97590CD4177CE6860EA7138F493B63CA03823720A8070BE5F0C81CDA6EF97061
    SPKI SHA256: 8F46FBFC161F9B8A5E3B9CAD70AE3A4A0280B85167A6FAF409CA74F2CDC1846A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### T-Systems SI CA

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=Systems Integration Region 1 Standort Berlin, commonName=T-Systems SI CA, emailAddress=pki@atriumberlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A97241B
- SHA-256: F4E5637DC16B239AE0B06E6F33C4F58A26E67AE317652783F7EE9C29E22ABA98
- SPKI SHA-256: 8F46FBFC161F9B8A5E3B9CAD70AE3A4A0280B85167A6FAF409CA74F2CDC1846A
- Validity: 2007-06-19 to 2019-06-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677339 (0xa97241b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:49:01 2007 GMT
            Not After : Jun 18 00:00:00 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = Systems Integration Region 1 Standort Berlin, CN = T-Systems SI CA, emailAddress = pki@atriumberlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:4D:D9:D3:94:AF:3E:B2:C4:78:E6:05:46:DC:17:88:60:A1:DB:6D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@atriumberlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F4E5637DC16B239AE0B06E6F33C4F58A26E67AE317652783F7EE9C29E22ABA98
    SPKI SHA256: 8F46FBFC161F9B8A5E3B9CAD70AE3A4A0280B85167A6FAF409CA74F2CDC1846A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### T-TeleSec Extended Validation SSL CA Class 3

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec Extended Validation SSL CA Class 3
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 02
- SHA-256: 36630D4A3C5A19FA82C303E97A5BD6E33FC7595DCE6AAA0C10B349418E1D7821
- SPKI SHA-256: F1095831DB8E1B05D28CAACE62484FCB93629B6298633605B9F4118A6502370B
- Validity: 2008-10-01 to 2018-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.telesec.de/en/serverpass/cps.html, http://www.telesec.de/en/serverpass/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Oct  1 10:48:14 2008 GMT
            Not After : Oct  1 23:59:59 2018 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec Extended Validation SSL CA Class 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                7B:90:4B:56:E5:55:43:6A:17:92:CB:51:9F:00:82:05:96:CF:5E:20
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 36630D4A3C5A19FA82C303E97A5BD6E33FC7595DCE6AAA0C10B349418E1D7821
    SPKI SHA256: F1095831DB8E1B05D28CAACE62484FCB93629B6298633605B9F4118A6502370B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### T-TeleSec GlobalCA Class 2

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalCA Class 2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 02
- SHA-256: 5DB6C9F86D2C135E79E5AC72A7087A4DABBA101BAD42D577DF68C74C204B9BEC
- SPKI SHA-256: 3FA906B74EFC52A28B7AAB40124F69ACB14618B10D1D807D765B5BB2EE054FD6
- Validity: 2008-10-01 to 2018-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pki.telesec.de/cps/cps.html, http://pki.telesec.de/cps/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Oct  1 10:56:50 2008 GMT
            Not After : Oct  1 23:59:59 2018 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalCA Class 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                7E:38:E1:D5:66:EB:97:37:C7:E6:9A:6E:14:B9:CC:2C:DC:AA:F0:EF
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5DB6C9F86D2C135E79E5AC72A7087A4DABBA101BAD42D577DF68C74C204B9BEC
    SPKI SHA256: 3FA906B74EFC52A28B7AAB40124F69ACB14618B10D1D807D765B5BB2EE054FD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### T-TeleSec GlobalRoot Class 2

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 119C148CC1AC0E95
- SHA-256: 09BC51517A97F66339E24D77E9CABE4E46695C2EC1B42A239E1EFBA7B72F328F
- SPKI SHA-256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
- Validity: 2016-04-25 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.telesec.de/en/serverpass/cps.html, http://www.telesec.de/en/serverpass/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.21
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1268911789788892821 (0x119c148cc1ac0e95)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Apr 25 09:01:39 2016 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.21
                  CPS: http://www.telesec.de/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp02.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 09BC51517A97F66339E24D77E9CABE4E46695C2EC1B42A239E1EFBA7B72F328F
    SPKI SHA256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.21
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### T-TeleSec GlobalRoot Class 2

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 010E
- SHA-256: A89C6829CE2AAD87813B39955ECB23C2EF5F70376ED6C48CCED856F620EB9C6D
- SPKI SHA-256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
- Validity: 2008-10-01 to 2018-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pki.telesec.de/cps/cps.html, http://pki.telesec.de/cps/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 270 (0x10e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Oct  1 15:15:15 2008 GMT
            Not After : Oct  1 23:59:59 2018 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            X509v3 Subject Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A89C6829CE2AAD87813B39955ECB23C2EF5F70376ED6C48CCED856F620EB9C6D
    SPKI SHA256: 6106C0E3A0A299831875127BD7D3CC1859803D511CAC11EB6E0840DD166FC10E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### T-TeleSec GlobalRoot Class 3

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 010D
- SHA-256: 558891E5602788A105293035CF5DA0E0A74550A9F68124B4C2B7D3CDF4E7D5D6
- SPKI SHA-256: 8D767764B3CBDA08929D072A22A561F4DCDD1BC57D3CBDDC948C47D2B47F9122
- Validity: 2008-10-01 to 2018-10-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pki.telesec.de/cps/cps.html, http://pki.telesec.de/cps/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 269 (0x10d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Oct  1 15:11:07 2008 GMT
            Not After : Oct  1 23:59:59 2018 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            X509v3 Subject Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 558891E5602788A105293035CF5DA0E0A74550A9F68124B4C2B7D3CDF4E7D5D6
    SPKI SHA256: 8D767764B3CBDA08929D072A22A561F4DCDD1BC57D3CBDDC948C47D2B47F9122
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://pki.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Technische Fachhochschule Georg Agricola zu Bochum - CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Technische Fachhochschule Georg Agricola zu Bochum, commonName=Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress=ca@tfh-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AFCCA9E
- SHA-256: 60E470AECE1A27BFB4CDF7766288F62DB2A3F92B049C59F1C93E5107F2C9D6BC
- SPKI SHA-256: BBE4AFCE7335D0750BE726A9C1CABF5DCFF59A7674121146772FF016CC33CCEE
- Validity: 2007-09-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 184339102 (0xafcca9e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep  4 12:18:24 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Technische Fachhochschule Georg Agricola zu Bochum, CN = Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress = ca@tfh-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6C:FD:2C:5B:6F:4A:15:20:1A:48:5C:83:5E:2E:97:12:D6:BF:87:0B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tfh-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 60E470AECE1A27BFB4CDF7766288F62DB2A3F92B049C59F1C93E5107F2C9D6BC
    SPKI SHA256: BBE4AFCE7335D0750BE726A9C1CABF5DCFF59A7674121146772FF016CC33CCEE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Technische Fachhochschule Georg Agricola zu Bochum - CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bochum, organizationName=Technische Fachhochschule Georg Agricola zu Bochum, commonName=Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress=ca@tfh-bochum.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248EA0BB3F
- SHA-256: 452BE41CC6AE1A3C407A2EDBD126658F3409C01096EDB6AB5AD5D0E1540F7EAB
- SPKI SHA-256: BBE4AFCE7335D0750BE726A9C1CABF5DCFF59A7674121146772FF016CC33CCEE
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401383021375 (0x17a4248ea0bb3f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:50 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bochum, O = Technische Fachhochschule Georg Agricola zu Bochum, CN = Technische Fachhochschule Georg Agricola zu Bochum - CA, emailAddress = ca@tfh-bochum.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6C:FD:2C:5B:6F:4A:15:20:1A:48:5C:83:5E:2E:97:12:D6:BF:87:0B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tfh-bochum.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 452BE41CC6AE1A3C407A2EDBD126658F3409C01096EDB6AB5AD5D0E1540F7EAB
    SPKI SHA256: BBE4AFCE7335D0750BE726A9C1CABF5DCFF59A7674121146772FF016CC33CCEE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Technische Universitaet Braunschweig CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Technische Universitaet Braunschweig, commonName=Technische Universitaet Braunschweig CA, emailAddress=pki@tu-bs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93DC3
- SHA-256: 78C6B41170519F243E139002444927E3D36922BD5405CB42E5EDDAE4589E0291
- SPKI SHA-256: 3B66E54D1791F45CE31140FA0C1C363DB307EF208318DC543A30DC0778130DCF
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329219 (0x9f93dc3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:20:21 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Technische Universitaet Braunschweig, CN = Technische Universitaet Braunschweig CA, emailAddress = pki@tu-bs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                14:8B:C9:E4:C5:D6:DC:7F:CF:8E:72:40:6B:E9:E7:ED:90:7C:79:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-bs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 78C6B41170519F243E139002444927E3D36922BD5405CB42E5EDDAE4589E0291
    SPKI SHA256: 3B66E54D1791F45CE31140FA0C1C363DB307EF208318DC543A30DC0778130DCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Technische Universitaet Braunschweig CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Braunschweig, organizationName=Technische Universitaet Braunschweig, commonName=Technische Universitaet Braunschweig CA, emailAddress=pki@tu-bs.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E6219390
- SHA-256: 9F40AC1129D4FCC10E8815C93DDF2143359784F1AAD798D9B20670B0CB0AA2DE
- SPKI SHA-256: 3B66E54D1791F45CE31140FA0C1C363DB307EF208318DC543A30DC0778130DCF
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670316565392 (0x179060e6219390)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:59 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Braunschweig, O = Technische Universitaet Braunschweig, CN = Technische Universitaet Braunschweig CA, emailAddress = pki@tu-bs.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                14:8B:C9:E4:C5:D6:DC:7F:CF:8E:72:40:6B:E9:E7:ED:90:7C:79:9F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-bs.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9F40AC1129D4FCC10E8815C93DDF2143359784F1AAD798D9B20670B0CB0AA2DE
    SPKI SHA256: 3B66E54D1791F45CE31140FA0C1C363DB307EF208318DC543A30DC0778130DCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Telekom Security BusinessID SMIME CA 2023

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security BusinessID SMIME CA 2023
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2BA09AD0508DC11731087798A8CDB3A9
- SHA-256: 6F25BD0E9E7492D15375089EB97C1C0747537336BB0FA82543BD2A485BE61A00
- SPKI SHA-256: 0CE21C19B4FB13DD9D5C8D053D8BA8642D0EC675F8B82364F66043766D4F7787
- Validity: 2023-06-20 to 2033-06-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.businessid.telesec.de/rl/Telekom_Security_BusinessID_SMIME_CA_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:a0:9a:d0:50:8d:c1:17:31:08:77:98:a8:cd:b3:a9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jun 20 09:21:45 2023 GMT
            Not After : Jun 19 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security BusinessID SMIME CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                98:08:F3:AB:95:5E:89:0E:A8:0E:27:10:81:6D:05:87:78:06:C7:A1
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6F25BD0E9E7492D15375089EB97C1C0747537336BB0FA82543BD2A485BE61A00
    SPKI SHA256: 0CE21C19B4FB13DD9D5C8D053D8BA8642D0EC675F8B82364F66043766D4F7787
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security DV ECC CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV ECC CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 37A66133041AD4A8F94DB9B77FBB9C71
- SHA-256: 688C275E88EBB382EED0AC7D8FAD62A8D0C7D0731D63A9CA31A67B6B1525E228
- SPKI SHA-256: B46599036F2517A2C98340EC8B9C85459586035C29978C486366B18C188803D4
- Validity: 2024-11-26 to 2034-11-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_DV_ECC_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:a6:61:33:04:1a:d4:a8:f9:4d:b9:b7:7f:bb:9c:71
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Nov 26 10:52:56 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security DV ECC CA 24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2D:7F:67:24:41:47:F5:30:EE:10:2C:3C:D0:55:F4:70:44:37:C1:87
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 688C275E88EBB382EED0AC7D8FAD62A8D0C7D0731D63A9CA31A67B6B1525E228
    SPKI SHA256: B46599036F2517A2C98340EC8B9C85459586035C29978C486366B18C188803D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security DV RSA CA 21

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 21
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2CF3C72F3F7D0FB31FC362D6B869558E
- SHA-256: 956FF9CC914874D9CAF9655BCCB696C1BE49A25BF928D5C41C0F5395A135D8B8
- SPKI SHA-256: C4A165CBC055083A744101F6CDAFBB673B2A605CF7D39AEA73462A30FB54ED4C
- Validity: 2021-04-21 to 2031-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pcsp.telesec.de/rl/Telekom_Security_DV_RSA_CA_21.crl, http://crl.serverid.telesec.de/rl/Telekom_Security_DV_RSA_CA_21.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:f3:c7:2f:3f:7d:0f:b3:1f:c3:62:d6:b8:69:55:8e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Apr 21 10:01:09 2021 GMT
            Not After : Apr 21 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security DV RSA CA 21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9E:8E:03:C5:17:7F:DA:04:6A:2F:CC:DB:22:D3:61:4B:CF:CF:E9:30
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 956FF9CC914874D9CAF9655BCCB696C1BE49A25BF928D5C41C0F5395A135D8B8
    SPKI SHA256: C4A165CBC055083A744101F6CDAFBB673B2A605CF7D39AEA73462A30FB54ED4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security DV RSA CA 22

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 22
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2103BE2C2AA30A5B5B1F0E1A4456239A
- SHA-256: 938E52642501DD16E23D8AEBFB97EB3C3B2562F50C324144C390946B29684A7E
- SPKI SHA-256: 3D08024764F28F6825E9DD84BEC6A846AFE13BD190735B0172637B42419429FE
- Validity: 2022-02-22 to 2032-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pcsp.telesec.de/rl/Telekom_Security_DV_RSA_CA_22.crl, http://crl.serverid.telesec.de/rl/Telekom_Security_DV_RSA_CA_22.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:03:be:2c:2a:a3:0a:5b:5b:1f:0e:1a:44:56:23:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 22 10:09:06 2022 GMT
            Not After : Feb 22 23:59:59 2032 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security DV RSA CA 22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F1:3D:3A:A6:5C:76:FD:BE:9C:A8:0D:0D:29:73:11:D1:1B:75:67:07
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 938E52642501DD16E23D8AEBFB97EB3C3B2562F50C324144C390946B29684A7E
    SPKI SHA256: 3D08024764F28F6825E9DD84BEC6A846AFE13BD190735B0172637B42419429FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security DV RSA CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security DV RSA CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 169CCBEDD87BCA6A8BBF388D292B5E51
- SHA-256: 46CFB832EF24FE305A50ADFCA11C9EF12F06210C550C0AE83505F025907915BE
- SPKI SHA-256: B506ED9B7519BABE49BF50A62F8779869189DC5BB785DA67215187578B3255AB
- Validity: 2024-11-26 to 2034-11-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_DV_RSA_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:9c:cb:ed:d8:7b:ca:6a:8b:bf:38:8d:29:2b:5e:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Nov 26 10:51:04 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security DV RSA CA 24
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8E:51:AB:3F:31:EC:D1:6C:2D:25:68:10:7F:28:EF:10:69:18:CC:C5
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 46CFB832EF24FE305A50ADFCA11C9EF12F06210C550C0AE83505F025907915BE
    SPKI SHA256: B506ED9B7519BABE49BF50A62F8779869189DC5BB785DA67215187578B3255AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV ECC CA 21

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV ECC CA 21
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 33DD8242A1BE7FE53D180891B64AD276
- SHA-256: D7A8A9947C31806C1B4625F82FCBCCA7CC2090E58DB215B8E4D88BA9C60D3166
- SPKI SHA-256: C0A424E90EAFA3742E99320C75F37AB8E399F4A88AF9C346BAD8614CCEBCD1B8
- Validity: 2021-04-21 to 2031-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pcsp.telesec.de/rl/Telekom_Security_EV_ECC_CA_21.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:dd:82:42:a1:be:7f:e5:3d:18:08:91:b6:4a:d2:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Apr 21 10:09:50 2021 GMT
            Not After : Apr 21 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV ECC CA 21
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                37:DC:40:76:CF:79:F0:FF:2A:1A:20:5E:1E:BB:F3:A3:02:5E:D7:EF
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D7A8A9947C31806C1B4625F82FCBCCA7CC2090E58DB215B8E4D88BA9C60D3166
    SPKI SHA256: C0A424E90EAFA3742E99320C75F37AB8E399F4A88AF9C346BAD8614CCEBCD1B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV ECC CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV ECC CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 3046C744F8F91337FDE66BBC99D86461
- SHA-256: 708E9E96AD5CE5C9B1F79137423FA98A81FFB087879B7BBE3DA71425742E2EEC
- SPKI SHA-256: BFC74E80495BA2B5B52141C211B66D670241021A5FD79F583A0DCA5B55B8D1D3
- Validity: 2024-11-26 to 2034-11-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_EV_ECC_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:46:c7:44:f8:f9:13:37:fd:e6:6b:bc:99:d8:64:61
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Nov 26 10:57:55 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV ECC CA 24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                89:D1:17:F3:E8:6E:D0:4C:6A:7B:A6:F1:C8:23:D5:51:60:BF:35:BD
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 708E9E96AD5CE5C9B1F79137423FA98A81FFB087879B7BBE3DA71425742E2EEC
    SPKI SHA256: BFC74E80495BA2B5B52141C211B66D670241021A5FD79F583A0DCA5B55B8D1D3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV RSA CA 22

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 22
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 1CD786631EC0CFBA0B52FA9B5E0287B1
- SHA-256: 86DB1D597419BC0FDDF2A6129DE46AF537752683A49CB9435C855F53637CFE13
- SPKI SHA-256: 54BE93F8B848CFF38141C3174D45BF2C71871986EB9DC7C3BC95681B9F54BC83
- Validity: 2022-06-21 to 2032-06-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-V3.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V4.0.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pcsp.telesec.de/rl/Telekom_Security_EV_RSA_CA_22.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- CRL DP: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:d7:86:63:1e:c0:cf:ba:0b:52:fa:9b:5e:02:87:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Jun 21 11:07:22 2022 GMT
            Not After : Jun 21 23:59:59 2032 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV RSA CA 22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                37:E4:B0:67:01:7A:BA:19:BF:03:9C:9A:CD:CF:67:E8:5F:05:F6:3C
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
            Authority Information Access:
                OCSP - URI:http://grcl3.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 86DB1D597419BC0FDDF2A6129DE46AF537752683A49CB9435C855F53637CFE13
    SPKI SHA256: 54BE93F8B848CFF38141C3174D45BF2C71871986EB9DC7C3BC95681B9F54BC83
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
- CRL Distribution Points: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV RSA CA 23

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 23
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 1B4F86F26635F18235E653190F7A32A5
- SHA-256: 9A6FC4AB4DB1EA6F6663507EDC1D008F091AE88FAB6F3AE56A84A4090529EF58
- SPKI SHA-256: 2AC137473A528629928590F1AEB531F2F32708C746164F68D34628526F21AB56
- Validity: 2023-03-28 to 2033-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pcsp.telesec.de/rl/Telekom_Security_EV_RSA_CA_23.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:4f:86:f2:66:35:f1:82:35:e6:53:19:0f:7a:32:a5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Mar 28 13:01:52 2023 GMT
            Not After : Mar 27 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV RSA CA 23
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3E:F6:EB:A3:FA:18:60:C7:4C:B5:2C:04:19:4B:2B:6A:11:1A:F7:0A
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9A6FC4AB4DB1EA6F6663507EDC1D008F091AE88FAB6F3AE56A84A4090529EF58
    SPKI SHA256: 2AC137473A528629928590F1AEB531F2F32708C746164F68D34628526F21AB56
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV RSA CA 23A

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 23A
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 3AAC4F8B5619C7B82CA8D613831E7CB2
- SHA-256: 82FBE865DA22D1F25ADF94BBD809D3F516125849E792DB7BB18452304C2ECC43
- SPKI SHA-256: EFA9E4499FDE4EC0F73705B20B7A1F98FB8A08853AC3832702CC10BCE07C54A9
- Validity: 2023-06-20 to 2033-06-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- CRL DP: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:ac:4f:8b:56:19:c7:b8:2c:a8:d6:13:83:1e:7c:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Jun 20 09:17:33 2023 GMT
            Not After : Jun 19 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV RSA CA 23A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8A:00:46:86:71:82:AC:6E:AC:22:F2:5E:F3:40:FF:EF:6E:A3:BE:27
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
            Authority Information Access:
                OCSP - URI:http://grcl3.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 82FBE865DA22D1F25ADF94BBD809D3F516125849E792DB7BB18452304C2ECC43
    SPKI SHA256: EFA9E4499FDE4EC0F73705B20B7A1F98FB8A08853AC3832702CC10BCE07C54A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
- CRL Distribution Points: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security EV RSA CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security EV RSA CA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 3253C5FA09678932B623F762F93B11F6
- SHA-256: C9A5C1A8848C3FE895EA32DBAA4BEDEBCDABF6833469E6EA9CB90E156EF1F09D
- SPKI SHA-256: 2280F2E17B91500A34FD6A675BB888F23C0F562D1D02003E84099E69DFC6239C
- Validity: 2025-02-27 to 2035-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_EV_RSA_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:53:c5:fa:09:67:89:32:b6:23:f7:62:f9:3b:11:f6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Feb 27 09:59:29 2025 GMT
            Not After : Feb 26 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security EV RSA CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:39:B0:8B:B6:EF:04:5F:14:D8:C6:54:CD:B7:0F:77:48:96:19:FC
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C9A5C1A8848C3FE895EA32DBAA4BEDEBCDABF6833469E6EA9CB90E156EF1F09D
    SPKI SHA256: 2280F2E17B91500A34FD6A675BB888F23C0F562D1D02003E84099E69DFC6239C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV ECC CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV ECC CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 18E45A4C42BA8A421F7D3C8130F19B7F
- SHA-256: 679C0CD9D0C4E893E0073250322304F0E7741067E0C92DB42B90FFB94144BBFB
- SPKI SHA-256: F88FB804012C9EF951309813A230C01F6C2BD60B46AF45741F4E60B96A004AA5
- Validity: 2024-11-26 to 2034-11-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_ECC_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            18:e4:5a:4c:42:ba:8a:42:1f:7d:3c:81:30:f1:9b:7f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Nov 26 10:56:21 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV ECC CA 24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                72:2C:26:73:70:2A:66:49:37:26:41:CE:4A:A4:B2:2F:D9:50:6A:FC
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 679C0CD9D0C4E893E0073250322304F0E7741067E0C92DB42B90FFB94144BBFB
    SPKI SHA256: F88FB804012C9EF951309813A230C01F6C2BD60B46AF45741F4E60B96A004AA5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV ECC CA 26

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV ECC CA 26
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 1AE7C919E39B08B1218175510C78B029
- SHA-256: 3E7843F9F7B5ADB7D8572E3E9ADB90361E3CD0E766BCC7403830F5BEA0DF2643
- SPKI SHA-256: 65C990230DD3E6CB2D56AA0B2AD952A7E88622B7B206CE87B87A0ABDA94F49BC
- Validity: 2026-03-19 to 2029-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_ECC_CA_26.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:e7:c9:19:e3:9b:08:b1:21:81:75:51:0c:78:b0:29
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Mar 19 10:20:57 2026 GMT
            Not After : Mar 18 23:59:59 2029 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV ECC CA 26
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F4:4E:51:0B:4E:7F:A0:75:72:32:0F:7D:97:2C:4B:E3:5C:F1:44:64
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3E7843F9F7B5ADB7D8572E3E9ADB90361E3CD0E766BCC7403830F5BEA0DF2643
    SPKI SHA256: 65C990230DD3E6CB2D56AA0B2AD952A7E88622B7B206CE87B87A0ABDA94F49BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV ECC qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV ECC qCA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 1FB28DE1BC2AB67D217A82D01FE2247E
- SHA-256: 771E7D6C2D77B7B90E1B4FF7DBFEA3E1AD7D249D0D729ED045567B5C16409276
- SPKI SHA-256: C323F2830A2E0EB999F498EB1EC4B26B8E210886C70743B58B720C21E536D051
- Validity: 2025-07-08 to 2035-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:b2:8d:e1:bc:2a:b6:7d:21:7a:82:d0:1f:e2:24:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Jul  8 11:01:59 2025 GMT
            Not After : Jul  7 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV ECC qCA 25
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A8:DF:8E:15:18:11:5A:96:3D:82:E6:65:8F:80:7F:C0:40:15:A6:E7
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 771E7D6C2D77B7B90E1B4FF7DBFEA3E1AD7D249D0D729ED045567B5C16409276
    SPKI SHA256: C323F2830A2E0EB999F498EB1EC4B26B8E210886C70743B58B720C21E536D051
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV ECC qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV ECC qualified CA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Serial: 1C575AF5E58C42DEEB5E01ADF281C0A4
- SHA-256: 378875A179C6A20ECD2E202F21BB2CCEF5F057FCD745ED4495CFF8286B3DD1EB
- SPKI SHA-256: 21BF414C8A9CE935E4D9A3D8B25C718983CF834BC445905134BB4DBF81826AB0
- Validity: 2025-10-23 to 2035-10-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_ECC_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- CRL DP: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:57:5a:f5:e5:8c:42:de:eb:5e:01:ad:f2:81:c0:a4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Validity
            Not Before: Oct 23 09:48:25 2025 GMT
            Not After : Oct 22 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV ECC qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                ED:02:05:41:C7:5B:DC:36:2A:53:E7:24:02:72:D4:3B:89:2E:22:E3
            X509v3 Authority Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
            Authority Information Access:
                OCSP - URI:http://tstlser20.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 378875A179C6A20ECD2E202F21BB2CCEF5F057FCD745ED4495CFF8286B3DD1EB
    SPKI SHA256: 21BF414C8A9CE935E4D9A3D8B25C718983CF834BC445905134BB4DBF81826AB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://tstlser20.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlser20.crt.telesec.de/crt/Telekom_Security_TLS_ECC_Root_2020.crt
- CRL Distribution Points: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV qCA 25
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0D0842DB796EC39957E1C15ED8C783C7
- SHA-256: 9805946CD46CD2F22276D463F582D4E811EE24025D8C17D6ED0ACE38F736674C
- SPKI SHA-256: F37C52A3C94F88307735F6ED1FC49FEA79DDE9AFF995FF683A8A10F3A71AD382
- Validity: 2025-07-08 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:08:42:db:79:6e:c3:99:57:e1:c1:5e:d8:c7:83:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jul  8 10:57:44 2025 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV qCA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                66:3D:EB:13:FC:27:37:E5:00:98:08:63:CA:22:39:4F:4A:8F:D9:58
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9805946CD46CD2F22276D463F582D4E811EE24025D8C17D6ED0ACE38F736674C
    SPKI SHA256: F37C52A3C94F88307735F6ED1FC49FEA79DDE9AFF995FF683A8A10F3A71AD382
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV qualified CA 25
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0A84EA4086D6C94D38CD7080D72582CD
- SHA-256: AC2930B9D77A3F0D253374FA01CD3F44E80184D60C5693637DFA2CC427C3E92B
- SPKI SHA-256: D70AF094306D26136A0E4184F2853F3E0962FCFB2968E6B19F1535D9B992D430
- Validity: 2025-10-23 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:84:ea:40:86:d6:c9:4d:38:cd:70:80:d7:25:82:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Oct 23 09:45:39 2025 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5D:38:4C:F9:59:3A:51:83:CC:76:E8:2B:A9:7C:85:FB:F5:BD:E5:A1
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AC2930B9D77A3F0D253374FA01CD3F44E80184D60C5693637DFA2CC427C3E92B
    SPKI SHA256: D70AF094306D26136A0E4184F2853F3E0962FCFB2968E6B19F1535D9B992D430
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA CA 22

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA CA 22
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 343262B23269E3DB202A1478136AC1AF
- SHA-256: D5D9445EEAA5576081DDF2E6C0904091BBC79BA10915E5215C8A2A7D87915FFD
- SPKI SHA-256: 7177C18A2250692A6A04A606B125A4AD4EFCACBE196A02ED301971243A13B9EB
- Validity: 2022-06-21 to 2032-06-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_RSA_CA_22.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:32:62:b2:32:69:e3:db:20:2a:14:78:13:6a:c1:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jun 21 10:59:15 2022 GMT
            Not After : Jun 21 23:59:59 2032 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV RSA CA 22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                81:87:0B:74:4E:02:08:38:F7:07:BE:C6:A0:84:14:E8:52:4D:8D:54
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D5D9445EEAA5576081DDF2E6C0904091BBC79BA10915E5215C8A2A7D87915FFD
    SPKI SHA256: 7177C18A2250692A6A04A606B125A4AD4EFCACBE196A02ED301971243A13B9EB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 05FFB4E698E1C239D369527B167459AC
- SHA-256: 2D815F28B2493BC25DEEA56148EC47879DDE8348B82096FCD1112FA4AB4902D3
- SPKI SHA-256: B853FA8A190C7D6C7D99C057ADAB43CAD66E85BB9EF29B31164090DFEC69F539
- Validity: 2024-11-26 to 2034-11-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_RSA_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:ff:b4:e6:98:e1:c2:39:d3:69:52:7b:16:74:59:ac
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Nov 26 10:54:54 2024 GMT
            Not After : Nov 25 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV RSA CA 24
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                98:F2:9F:25:82:F6:4B:CC:BC:7C:46:BF:B9:4E:DD:FF:F0:E1:E2:D8
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2D815F28B2493BC25DEEA56148EC47879DDE8348B82096FCD1112FA4AB4902D3
    SPKI SHA256: B853FA8A190C7D6C7D99C057ADAB43CAD66E85BB9EF29B31164090DFEC69F539
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA CA 26A

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA CA 26A
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 118282E70C01C7416642DD8576CED055
- SHA-256: C76E23DFA0014B885A6DED8E6D64C295AF4991DC7872C1AF8B0FEF527E263929
- SPKI SHA-256: 0D31C802D1CB391E859989D64F404EF1AEF2EC43DCD047E4E978394364D981C4
- Validity: 2026-03-19 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_RSA_CA_26A.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:82:82:e7:0c:01:c7:41:66:42:dd:85:76:ce:d0:55
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Mar 19 10:24:23 2026 GMT
            Not After : Mar 18 23:59:59 2029 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV RSA CA 26A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                5E:89:9D:9F:06:28:A1:60:62:FF:E7:4F:C4:AA:E2:50:F9:D5:3B:62
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C76E23DFA0014B885A6DED8E6D64C295AF4991DC7872C1AF8B0FEF527E263929
    SPKI SHA256: 0D31C802D1CB391E859989D64F404EF1AEF2EC43DCD047E4E978394364D981C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA CA 26B

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA CA 26B
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 3F6BADDDEDBE53BC7D5881FC0D42BFC0
- SHA-256: 2082B641B4AD7F20A8CEE7F1FB85571EA461222FE933DFF2FB246ED5AC7EADA2
- SPKI SHA-256: 03C6448199C4BE53F9AE889FA21F2349273A5C8B2C8A1C1EE067A024E40C3207
- Validity: 2026-03-19 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.businessid.telesec.de/rl/Telekom_Security_OV_RSA_CA_26B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:6b:ad:dd:ed:be:53:bc:7d:58:81:fc:0d:42:bf:c0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Mar 19 10:26:45 2026 GMT
            Not After : Mar 18 23:59:59 2029 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV RSA CA 26B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:14:89:BC:BD:CF:2F:C5:32:7C:66:C2:96:58:3D:0E:8A:7F:A9:B5
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2082B641B4AD7F20A8CEE7F1FB85571EA461222FE933DFF2FB246ED5AC7EADA2
    SPKI SHA256: 03C6448199C4BE53F9AE889FA21F2349273A5C8B2C8A1C1EE067A024E40C3207
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security OV RSA qCA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 12886F0045AF0D4A4F066CE9AC25E000
- SHA-256: 46E776EA7C6C0F91F1CDE31755F864C45A61812F1C378ED5594E13BB4DE633C3
- SPKI SHA-256: D8F7AD9A90F2205DE5AAF4988984322870871A75B43FB0DD202D4C9C34447877
- Validity: 2025-07-08 to 2035-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:88:6f:00:45:af:0d:4a:4f:06:6c:e9:ac:25:e0:00
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Jul  8 11:05:08 2025 GMT
            Not After : Jul  7 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security OV RSA qCA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E2:71:80:81:C2:37:B2:31:62:8E:59:85:8B:AA:D1:F6:82:26:CD:13
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 46E776EA7C6C0F91F1CDE31755F864C45A61812F1C378ED5594E13BB4DE633C3
    SPKI SHA256: D8F7AD9A90F2205DE5AAF4988984322870871A75B43FB0DD202D4C9C34447877
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security OV RSA qualified CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, organizationIdentifier=NTRDE-DER3201.HRB15241, commonName=Telekom Security OV RSA qualified CA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Serial: 25F8193F16D6103AA6C2E43664CBC672
- SHA-256: AF33778A2215533739B9FB3A2E38D9B66D44785B6C0803D2C1E2CEB54503DD61
- SPKI SHA-256: 45FCF5D55E6CD756693817ABC506C95F64E1322A5F3E366BC5591CD239B5262C
- Validity: 2025-10-23 to 2035-10-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_OV_RSA_qualified_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            25:f8:19:3f:16:d6:10:3a:a6:c2:e4:36:64:cb:c6:72
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Validity
            Not Before: Oct 23 09:50:46 2025 GMT
            Not After : Oct 22 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, organizationIdentifier = NTRDE-DER3201.HRB15241, CN = Telekom Security OV RSA qualified CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:0F:D7:80:05:5C:B6:D6:24:16:12:87:2D:00:63:98:D0:8C:6B:75
            X509v3 Authority Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tstlsrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.194112.1.5
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AF33778A2215533739B9FB3A2E38D9B66D44785B6C0803D2C1E2CEB54503DD61
    SPKI SHA256: 45FCF5D55E6CD756693817ABC506C95F64E1322A5F3E366BC5591CD239B5262C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.194112.1.5
- AIA OCSP: http://tstlsrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tstlsrr23.crt.telesec.de/crt/Telekom_Security_TLS_RSA_Root_2023.crt
- CRL Distribution Points: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security ServerID EV Class 3 CA

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security ServerID EV Class 3 CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 08D391DB6DD2430347FEB010945B46B9
- SHA-256: 5092CE0E3F70F2FD9561C34623B546F7D333EF1B633C147D1290E28DE986A230
- SPKI SHA-256: B0B5602DED6733C24C21B5265593BE8BB06231E0BA7878BE7B306601DBB38813
- Validity: 2022-08-02 to 2027-08-02
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_ServerID_EV_Class_3_CA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- CRL DP: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:d3:91:db:6d:d2:43:03:47:fe:b0:10:94:5b:46:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Aug  2 09:24:13 2022 GMT
            Not After : Aug  2 23:59:59 2027 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security ServerID EV Class 3 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                45:B3:1F:68:0A:BD:A2:A7:F9:DC:A0:C4:DE:0E:CE:D9:74:0D:08:E7
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
            Authority Information Access:
                OCSP - URI:http://grcl3.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5092CE0E3F70F2FD9561C34623B546F7D333EF1B633C147D1290E28DE986A230
    SPKI SHA256: B0B5602DED6733C24C21B5265593BE8BB06231E0BA7878BE7B306601DBB38813
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4
- AIA OCSP: http://grcl3.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
- CRL Distribution Points: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Telekom Security ServerID OV Class 2 CA

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security ServerID OV Class 2 CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0E5D298915C40431A4E1C4CA488B8EA3
- SHA-256: 944ACE961DB316BEB694E01C302C46FED40DC0291729E7DAF58550C3CB55E791
- SPKI SHA-256: F4AE11C0A420CDDF883A6FAFBD59C7905C2F955D760382CEBAEB89EFFD96A3C4
- Validity: 2022-08-02 to 2027-08-02
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverid.telesec.de/rl/Telekom_Security_ServerID_OV_Class_2_CA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:5d:29:89:15:c4:04:31:a4:e1:c4:ca:48:8b:8e:a3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Aug  2 09:16:44 2022 GMT
            Not After : Aug  2 23:59:59 2027 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security ServerID OV Class 2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1C:05:93:B1:7F:A8:34:30:8C:52:E0:96:40:A0:72:A3:10:5D:E0:FF
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 944ACE961DB316BEB694E01C302C46FED40DC0291729E7DAF58550C3CB55E791
    SPKI SHA256: F4AE11C0A420CDDF883A6FAFBD59C7905C2F955D760382CEBAEB89EFFD96A3C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Telekom Security SMIME CA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME CA 25
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2028A680463346324CF185CB14764B02
- SHA-256: BE096522370C4BABCA86876B3060A94FC3D157613C3500606A9E5691DA7D11E7
- SPKI SHA-256: 3A7E797B4A8534C46FD1A8E98B43C3C482170680295EDD010BF186F6600C54B7
- Validity: 2025-02-27 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Telekom_Security_SMIME_CA_25.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:28:a6:80:46:33:46:32:4c:f1:85:cb:14:76:4b:02
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 27 09:53:50 2025 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME CA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                97:8F:3D:62:91:3B:B1:66:E5:6A:BD:50:58:99:91:0C:01:C5:F4:01
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BE096522370C4BABCA86876B3060A94FC3D157613C3500606A9E5691DA7D11E7
    SPKI SHA256: 3A7E797B4A8534C46FD1A8E98B43C3C482170680295EDD010BF186F6600C54B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME ECC CA 23

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC CA 23
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 35725DDC0E0E5C48DA05CBEB4D7723F5
- SHA-256: EA45DD36FD0CA91706080F68F7213D55E658249A20C81AFDD34E80CC5EC3E349
- SPKI SHA-256: 65969C8A3BA3130B9B949043CE00FF1F4F492E177EE15663958FDED2705A44FD
- Validity: 2023-03-28 to 2033-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.businessid.telesec.de/rl/Telekom_Security_SMIME_ECC_CA_23.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- CRL DP: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:72:5d:dc:0e:0e:5c:48:da:05:cb:eb:4d:77:23:f5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Mar 28 12:52:17 2023 GMT
            Not After : Mar 27 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC CA 23
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                47:0D:26:F5:91:BF:FD:FF:BA:78:F4:CE:60:96:23:F3:4B:24:06:10
            X509v3 Authority Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
            Authority Information Access:
                OCSP - URI:http://tssmer21.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EA45DD36FD0CA91706080F68F7213D55E658249A20C81AFDD34E80CC5EC3E349
    SPKI SHA256: 65969C8A3BA3130B9B949043CE00FF1F4F492E177EE15663958FDED2705A44FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
- CRL Distribution Points: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME ECC CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 0D0BB583E19CA6AFEEDB6A52F9675B6E
- SHA-256: F33B1859C34A063E941DC7D8F3F5378833C4770D48B7454EE1CDCD9A8194935A
- SPKI SHA-256: C633FA02A29D6B6ECAAE3CB2DAE97877B749E4400AEF47AB84044A2515E3E7EC
- Validity: 2024-02-13 to 2034-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Telekom_Security_SMIME_ECC_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- CRL DP: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:0b:b5:83:e1:9c:a6:af:ee:db:6a:52:f9:67:5b:6e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Feb 13 09:45:02 2024 GMT
            Not After : Feb 12 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC CA 24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                33:C5:9A:56:26:B7:6B:B1:B3:5F:7F:9F:15:78:0F:C7:16:F8:50:17
            X509v3 Authority Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
            Authority Information Access:
                OCSP - URI:http://tssmer21.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F33B1859C34A063E941DC7D8F3F5378833C4770D48B7454EE1CDCD9A8194935A
    SPKI SHA256: C633FA02A29D6B6ECAAE3CB2DAE97877B749E4400AEF47AB84044A2515E3E7EC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
- CRL Distribution Points: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME ECC qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC qCA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME ECC Root 2021
- Serial: 3E10702C77C532BF198261692DEF3240
- SHA-256: 36F375683981A8EAB6C4F36CE4A809D3EA265C6FD58D587E7317161A724DA8DD
- SPKI SHA-256: 5C2C4AE41CB7B80C0F652255EF47429E86440BF942E5D6364CBBD6F100419FF7
- Validity: 2025-07-08 to 2035-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- CRL DP: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:10:70:2c:77:c5:32:bf:19:82:61:69:2d:ef:32:40
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC Root 2021
        Validity
            Not Before: Jul  8 10:52:54 2025 GMT
            Not After : Jul  7 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME ECC qCA 25
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D4:EA:57:F9:50:0C:CB:8E:E0:6C:10:E7:DF:96:C5:BF:9A:54:A4:D5
            X509v3 Authority Key Identifier:
                2B:CB:01:0C:63:C3:53:12:A5:A8:57:AF:D0:9C:83:FB:BD:90:3A:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
            Authority Information Access:
                OCSP - URI:http://tssmer21.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 36F375683981A8EAB6C4F36CE4A809D3EA265C6FD58D587E7317161A724DA8DD
    SPKI SHA256: 5C2C4AE41CB7B80C0F652255EF47429E86440BF942E5D6364CBBD6F100419FF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://tssmer21.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmer21.crt.telesec.de/crt/Telekom_Security_SMIME_ECC_Root_2021.crt
- CRL Distribution Points: http://tssmer21.crl.telesec.de/rl/Telekom_Security_SMIME_ECC_Root_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME qCA 25
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0D30AC5CC9D6636226A89424080EC56B
- SHA-256: 83EA688E78ECCC5D2CEA19ABD680DA6341F50CD1470D9F9BFAF7F5E147E40FDB
- SPKI SHA-256: 2A5CD3C41611EC94B65B42FDA44AA218B72D2D788CBBD60928CA8951CA1F93C5
- Validity: 2025-07-08 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:30:ac:5c:c9:d6:63:62:26:a8:94:24:08:0e:c5:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jul  8 10:49:00 2025 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME qCA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3C:0A:D4:47:9D:F8:93:84:3C:E5:A1:B7:8F:17:C2:89:F2:C2:75:68
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 83EA688E78ECCC5D2CEA19ABD680DA6341F50CD1470D9F9BFAF7F5E147E40FDB
    SPKI SHA256: 2A5CD3C41611EC94B65B42FDA44AA218B72D2D788CBBD60928CA8951CA1F93C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME RSA CA 23

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA CA 23
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: 1AD93EB6F9C336044B65F46E6E6A116E
- SHA-256: EB48699C89C702DAC2C05F483396489BBBF71AA0ACAC0F52596A5DE97CEBD913
- SPKI SHA-256: 5EE077A2340B3E9B97FEA3F7C98A20D4D982E9758EFB02AAE99AF2CE9466CA24
- Validity: 2023-03-28 to 2033-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.businessid.telesec.de/rl/Telekom_Security_SMIME_RSA_CA_23.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:d9:3e:b6:f9:c3:36:04:4b:65:f4:6e:6e:6a:11:6e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Mar 28 12:57:38 2023 GMT
            Not After : Mar 27 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA CA 23
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                43:3A:08:77:FF:C9:E4:D8:83:A5:8A:CC:C0:84:82:94:40:6E:58:1E
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tssmrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EB48699C89C702DAC2C05F483396489BBBF71AA0ACAC0F52596A5DE97CEBD913
    SPKI SHA256: 5EE077A2340B3E9B97FEA3F7C98A20D4D982E9758EFB02AAE99AF2CE9466CA24
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
- CRL Distribution Points: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME RSA CA 24

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA CA 24
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: 05551224E4D3286C3ADE14178F48F807
- SHA-256: 0E2CFE3B15D2A754BD86DDDA077AC4A3DF961A9FA6B59278DD72098024D04567
- SPKI SHA-256: FC46A1501630ABFFCCE923FFA265A40C09378AB931B555778DFA705DE6E2519F
- Validity: 2024-02-13 to 2034-02-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.clientid.telesec.de/rl/Telekom_Security_SMIME_RSA_CA_24.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:55:12:24:e4:d3:28:6c:3a:de:14:17:8f:48:f8:07
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Feb 13 09:54:11 2024 GMT
            Not After : Feb 12 23:59:59 2034 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA CA 24
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8B:A8:54:E3:CF:2C:47:35:D3:5C:62:2B:30:E3:22:93:EA:AE:BC:44
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tssmrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0E2CFE3B15D2A754BD86DDDA077AC4A3DF961A9FA6B59278DD72098024D04567
    SPKI SHA256: FC46A1501630ABFFCCE923FFA265A40C09378AB931B555778DFA705DE6E2519F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
- CRL Distribution Points: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security SMIME RSA qCA 25

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA qCA 25
- Issuer: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security SMIME RSA Root 2023
- Serial: CF290C0771097B5411284BA5D68706
- SHA-256: 67EF963EDBCBB462FF44597525BE5A592A50146B60B1E0E133378127DE7FC213
- SPKI SHA-256: 0737D75CFB497FD20E001023917FA2F166D5B6A738D923DCF1EC76DDE548D85D
- Validity: 2025-07-08 to 2035-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- CRL DP: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            cf:29:0c:07:71:09:7b:54:11:28:4b:a5:d6:87:06
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA Root 2023
        Validity
            Not Before: Jul  8 10:55:04 2025 GMT
            Not After : Jul  7 23:59:59 2035 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security SMIME RSA qCA 25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BA:CE:BC:A7:70:21:95:61:B8:05:C8:76:A3:FE:23:80:C4:54:71:0F
            X509v3 Authority Key Identifier:
                9A:CE:AC:2A:EC:01:FA:65:70:DE:97:9D:F1:D2:00:8C:A5:A3:64:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
            Authority Information Access:
                OCSP - URI:http://tssmrr23.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.2.2
                Policy: 0.4.0.194112.1.0
                Policy: 0.4.0.194112.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 67EF963EDBCBB462FF44597525BE5A592A50146B60B1E0E133378127DE7FC213
    SPKI SHA256: 0737D75CFB497FD20E001023917FA2F166D5B6A738D923DCF1EC76DDE548D85D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.4.2, 2.23.140.1.5.2.2, 0.4.0.194112.1.0, 0.4.0.194112.1.1
- AIA OCSP: http://tssmrr23.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://tssmrr23.crt.telesec.de/crt/Telekom_Security_SMIME_RSA_Root_2023.crt
- CRL Distribution Points: http://tssmrr23.crl.telesec.de/rl/Telekom_Security_SMIME_RSA_Root_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telekom Security TLS ECC Root 2020

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS ECC Root 2020
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 161CC80447599ECF6AAA8BF8B224EE0E
- SHA-256: 4DCE5A017BB3D81ACF823E815AABCB83752AD3E2883B359DF42935DFBD497075
- SPKI SHA-256: EAB0DE5A46419010B01B2D55553FC111AA82B43D9395EDFEAEAA8C76E6AD1995
- Validity: 2026-03-19 to 2033-09-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://tstlser20.crl.telesec.de/rl/Telekom_Security_TLS_ECC_Root_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:1c:c8:04:47:59:9e:cf:6a:aa:8b:f8:b2:24:ee:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Mar 19 12:06:48 2026 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS ECC Root 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E3:72:CC:6E:95:99:47:B1:E6:B3:61:4C:D1:CB:AB:E3:BA:CD:DE:9F
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
            Authority Information Access:
                CA Issuers - URI:http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DCE5A017BB3D81ACF823E815AABCB83752AD3E2883B359DF42935DFBD497075
    SPKI SHA256: EAB0DE5A46419010B01B2D55553FC111AA82B43D9395EDFEAEAA8C76E6AD1995
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
- CRL Distribution Points: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Telekom Security TLS RSA Root 2023

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=Telekom Security TLS RSA Root 2023
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 238B36076DF8ACDACF7EB300492781B3
- SHA-256: 6306C491F9D1CECEDEF46420E028601922C0106DD0B48A61A7454F9ED38CD649
- SPKI SHA-256: 0E05E9BB23869EB689DC56839DCEC475A3AE75FA6B50BC5A4978360CBE673323
- Validity: 2026-03-19 to 2033-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://tstlsrr23.crl.telesec.de/rl/Telekom_Security_TLS_RSA_Root_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:8b:36:07:6d:f8:ac:da:cf:7e:b3:00:49:27:81:b3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Mar 19 12:03:19 2026 GMT
            Not After : Sep 30 23:59:59 2033 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = Telekom Security TLS RSA Root 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B6:A7:97:82:3D:74:85:9B:F7:3C:9F:93:9A:95:79:75:52:8C:6D:47
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
            Authority Information Access:
                CA Issuers - URI:http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6306C491F9D1CECEDEF46420E028601922C0106DD0B48A61A7454F9ED38CD649
    SPKI SHA256: 0E05E9BB23869EB689DC56839DCEC475A3AE75FA6B50BC5A4978360CBE673323
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://grcl3.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_3.crt
- CRL Distribution Points: http://grcl3.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### TeleSec Business CA 1

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec Business CA 1
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 488D025DD6F4
- SHA-256: 44EBF0123E27FF1DB0497BD2DAE18155B2A414E6BCD9C6C8FB8F48398449B9E9
- SPKI SHA-256: 5E65CE4FD357428BA6FEFC2BF3BEB1107D2A097980DD99DC043CA26ED917A505
- Validity: 2012-11-29 to 2024-11-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sbca.telesec.de/rl/TeleSec_Business_CA_1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp04.telesec.de/ocspr
- CRL DP: http://crl.sbca.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://ldap.sbca.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 79770467292916 (0x488d025dd6f4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Nov 29 11:23:55 2012 GMT
            Not After : Nov 29 23:59:59 2024 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec Business CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                86:88:93:1F:8B:EB:55:96:65:D5:47:01:BD:37:8C:7C:CD:A8:C7:A3
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.25
                  CPS: http://sbca.telesec.de/cps/cps2.pdf
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sbca.telesec.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://ldap.sbca.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp04.telesec.de/ocspr
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 44EBF0123E27FF1DB0497BD2DAE18155B2A414E6BCD9C6C8FB8F48398449B9E9
    SPKI SHA256: 5E65CE4FD357428BA6FEFC2BF3BEB1107D2A097980DD99DC043CA26ED917A505
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- AIA OCSP: http://ocsp04.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.sbca.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://ldap.sbca.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### TeleSec Business CA 20 G2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec Business CA 20 G2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 635DD7644A6B6573
- SHA-256: 7368DB181BA758FC774C30764D1C86FE0B0F91B02F855B1520FCCDB76D9D0275
- SPKI SHA-256: 09E110817DA730A43DE933C44D08C79DFA0AE97D3D4050C0438ABCE572643A17
- Validity: 2017-03-09 to 2027-03-09
- Key: EC 256 prime256v1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://sbca.telesec.de/cps/cps2.pdf, http://sbca.telesec.de/cps/cps2.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl, ldap://grcl2.ldap.telesec.de/CN=TeleSec%GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7160115808334210419 (0x635dd7644a6b6573)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Mar  9 11:45:33 2017 GMT
            Not After : Mar  9 23:59:59 2027 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec Business CA 20 G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.25
                  CPS: http://grcl2.docs.telesec.de/cps/sbca.htm
                Policy: 2.23.140.1.2.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://grcl2.ldap.telesec.de/CN=TeleSec%GlobalRoot%20Class%202,OU=T-Systems%20Trust%20Center,O=T-Systems%20International%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Subject Key Identifier:
                15:69:5D:63:41:87:A2:EA:19:9C:2A:48:E8:34:F5:31:3B:E5:99:2B
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7368DB181BA758FC774C30764D1C86FE0B0F91B02F855B1520FCCDB76D9D0275
    SPKI SHA256: 09E110817DA730A43DE933C44D08C79DFA0AE97D3D4050C0438ABCE572643A17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.25, 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl, ldap://grcl2.ldap.telesec.de/CN=TeleSec%GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TeleSec Business CA 2021

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business CA 2021
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 063E52C88B03E76980BD239FE1D8A71F
- SHA-256: 7732599AAF35853E0351E49F8057BBF5321777E83603C38570065056A56FA68B
- SPKI SHA-256: BA240B4A619A99D7543843834EA35459D3B61EE885DCF97A448241EC4038EF94
- Validity: 2021-11-17 to 2031-11-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-V3.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V4.0.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:3e:52:c8:8b:03:e7:69:80:bd:23:9f:e1:d8:a7:1f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Nov 17 11:22:25 2021 GMT
            Not After : Nov 17 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = TeleSec Business CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                E7:0B:B8:DC:A2:0B:16:07:59:4A:C6:CA:53:2D:BF:F9:FA:A9:ED:BF
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7732599AAF35853E0351E49F8057BBF5321777E83603C38570065056A56FA68B
    SPKI SHA256: BA240B4A619A99D7543843834EA35459D3B61EE885DCF97A448241EC4038EF94
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec Business CA 21

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business CA 21
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 0A24891F3A57BA661BC3CEA83A9A3243
- SHA-256: 06B58F124B45E9417708F60CDDAEB6F39B72206FE4BD40EE2E20E628DDFDD33D
- SPKI SHA-256: BA240B4A619A99D7543843834EA35459D3B61EE885DCF97A448241EC4038EF94
- Validity: 2021-11-17 to 2031-11-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sbca.telesec.de/rl/TeleSec_Business_CA_21.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:24:89:1f:3a:57:ba:66:1b:c3:ce:a8:3a:9a:32:43
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Nov 17 14:10:09 2021 GMT
            Not After : Nov 17 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = TeleSec Business CA 21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                E7:0B:B8:DC:A2:0B:16:07:59:4A:C6:CA:53:2D:BF:F9:FA:A9:ED:BF
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 06B58F124B45E9417708F60CDDAEB6F39B72206FE4BD40EE2E20E628DDFDD33D
    SPKI SHA256: BA240B4A619A99D7543843834EA35459D3B61EE885DCF97A448241EC4038EF94
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec Business TLS-CA 2021

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 2021
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 02FA63C1BC05050A61061B6C9D84FE97
- SHA-256: A712E2126EA4CAC6A5EE860D2F3E0CE03CDFD232A9E7911B7CFE2C4B12A228FA
- SPKI SHA-256: 1F037E5D64ECC2BE7433FFBA02B5577DC4229FFD34CD8BD635E79B0E43F66152
- Validity: 2021-11-17 to 2031-11-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CP-EN-V3.0.pdf, https://www.telesec.de/assets/downloads/PKI-Repository/Telekom-Security-CPS-Public-EN-V4.0.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:fa:63:c1:bc:05:05:0a:61:06:1b:6c:9d:84:fe:97
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Nov 17 11:25:48 2021 GMT
            Not After : Nov 17 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = TeleSec Business TLS-CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                F9:66:CB:20:16:B5:1C:D6:63:1A:C7:AE:7D:A6:66:94:F3:1F:C2:D2
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A712E2126EA4CAC6A5EE860D2F3E0CE03CDFD232A9E7911B7CFE2C4B12A228FA
    SPKI SHA256: 1F037E5D64ECC2BE7433FFBA02B5577DC4229FFD34CD8BD635E79B0E43F66152
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec Business TLS-CA 2022

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 2022
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 184D6BB87845A9671E78F69D1CE8AB8B
- SHA-256: A3F2A10A366AFF774CBB4E6EC4C8A8EF707C03E932B4C46E5078767AACF1ED60
- SPKI SHA-256: 126438E527207A49804FC00EE76692E4F8D9E720FEEAAB6A9FAB5795BE1F03AB
- Validity: 2022-06-21 to 2032-06-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sbca.telesec.de/rl/TeleSec_Business_TLS-CA_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            18:4d:6b:b8:78:45:a9:67:1e:78:f6:9d:1c:e8:ab:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Jun 21 11:14:51 2022 GMT
            Not After : Jun 21 23:59:59 2032 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = TeleSec Business TLS-CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                37:5E:AA:A8:14:DB:B9:58:70:8C:9D:B9:38:41:73:0D:87:18:AD:0F
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A3F2A10A366AFF774CBB4E6EC4C8A8EF707C03E932B4C46E5078767AACF1ED60
    SPKI SHA256: 126438E527207A49804FC00EE76692E4F8D9E720FEEAAB6A9FAB5795BE1F03AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec Business TLS-CA 21

- Subject: countryName=DE, organizationName=Deutsche Telekom Security GmbH, commonName=TeleSec Business TLS-CA 21
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2ACED5F91C42F2BF918B5B8093A8C024
- SHA-256: F00E616B59ED06E6CC9717D039F7A1A70CB3D08E0B6AD74653670CCE448C61F3
- SPKI SHA-256: 1F037E5D64ECC2BE7433FFBA02B5577DC4229FFD34CD8BD635E79B0E43F66152
- Validity: 2021-11-17 to 2031-11-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sbca.telesec.de/rl/TeleSec_Business_TLS-CA_21.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2a:ce:d5:f9:1c:42:f2:bf:91:8b:5b:80:93:a8:c0:24
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Nov 17 14:12:18 2021 GMT
            Not After : Nov 17 23:59:59 2031 GMT
        Subject: C = DE, O = Deutsche Telekom Security GmbH, CN = TeleSec Business TLS-CA 21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                F9:66:CB:20:16:B5:1C:D6:63:1A:C7:AE:7D:A6:66:94:F3:1F:C2:D2
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://grcl2.ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F00E616B59ED06E6CC9717D039F7A1A70CB3D08E0B6AD74653670CCE448C61F3
    SPKI SHA256: 1F037E5D64ECC2BE7433FFBA02B5577DC4229FFD34CD8BD635E79B0E43F66152
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://grcl2.ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2.crt.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.crt
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec GlobalRoot Class 2 G2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 2 G2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 2712C06105E55F37F6C29315C405243F
- SHA-256: 05503F08D2DC8EDD2467CD211E6DC356BB1B7869FEA2B62F697DC136B7960675
- SPKI SHA-256: 1B5312330C9619D5A3750680AA4CCE98A28A4802D9E598DF9D95D41F93233191
- Validity: 2019-02-12 to 2029-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.23
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:12:c0:61:05:e5:5f:37:f6:c2:93:15:c4:05:24:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 12 12:29:15 2019 GMT
            Not After : Feb 12 23:59:59 2029 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec GlobalRoot Class 2 G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.23
                  CPS: http://www.telesec.de/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl2g2.pki.telesec.de/crt/GlobalRoot_Class_2.cer
            X509v3 Subject Key Identifier:
                B3:F8:34:F3:5A:88:88:C0:E9:B7:D6:7C:E9:B8:C5:92:D4:87:BD:A3
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 05503F08D2DC8EDD2467CD211E6DC356BB1B7869FEA2B62F697DC136B7960675
    SPKI SHA256: 1B5312330C9619D5A3750680AA4CCE98A28A4802D9E598DF9D95D41F93233191
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.23
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl2g2.pki.telesec.de/crt/GlobalRoot_Class_2.cer
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec GlobalRoot Class 2 G2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 2 G2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: D32201F3292E509C
- SHA-256: F26D9A4C930D0F50289976D38C4EE952F3B9142CC17EC3F484A206A7B7F40322
- SPKI SHA-256: 1B5312330C9619D5A3750680AA4CCE98A28A4802D9E598DF9D95D41F93233191
- Validity: 2016-02-23 to 2026-02-23
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pki.telesec.de/cps/cps.html, http://pki.telesec.de/cps/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.23
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:22:01:f3:29:2e:50:9c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 23 10:41:27 2016 GMT
            Not After : Feb 23 23:59:59 2026 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec GlobalRoot Class 2 G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.23
                  CPS: http://www.telesec.de/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                B3:F8:34:F3:5A:88:88:C0:E9:B7:D6:7C:E9:B8:C5:92:D4:87:BD:A3
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F26D9A4C930D0F50289976D38C4EE952F3B9142CC17EC3F484A206A7B7F40322
    SPKI SHA256: 1B5312330C9619D5A3750680AA4CCE98A28A4802D9E598DF9D95D41F93233191
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.23
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### TeleSec GlobalRoot Class 3 G2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 3 G2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 909B7E9B58F378CF
- SHA-256: C6A0F8195346E7F8A7CC0E1525BBF8C55A220CBF742DD11C5CAF49F871C53310
- SPKI SHA-256: 5FD46EB15CCD7587406F0711C142F0535C2EE44EBAE52C0CED28854B6F41E4E2
- Validity: 2016-02-23 to 2026-02-23
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.telesec.de/en/serverpass/cps.html, http://www.telesec.de/en/serverpass/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.24
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            90:9b:7e:9b:58:f3:78:cf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Feb 23 10:47:06 2016 GMT
            Not After : Feb 23 23:59:59 2026 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec GlobalRoot Class 3 G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.24
                  CPS: http://www.telesec.de/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                F3:58:C5:3C:A9:74:4C:0D:AD:36:CC:00:6F:2C:C5:86:1E:38:71:02
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C6A0F8195346E7F8A7CC0E1525BBF8C55A220CBF742DD11C5CAF49F871C53310
    SPKI SHA256: 5FD46EB15CCD7587406F0711C142F0535C2EE44EBAE52C0CED28854B6F41E4E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.24
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### TeleSec GlobalRoot Class 3 G2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec GlobalRoot Class 3 G2
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 1F4669BE5B26404D902D3A97483ACAE2
- SHA-256: 89C82431C45C730113CF570FAF37FA4E62F9A57C8232A98CEDC7E6FF89326C43
- SPKI SHA-256: 5FD46EB15CCD7587406F0711C142F0535C2EE44EBAE52C0CED28854B6F41E4E2
- Validity: 2019-02-12 to 2029-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.24
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:46:69:be:5b:26:40:4d:90:2d:3a:97:48:3a:ca:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Feb 12 12:23:03 2019 GMT
            Not After : Feb 12 23:59:59 2029 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec GlobalRoot Class 3 G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.24
                  CPS: http://www.telesec.de/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
                CA Issuers - URI:http://grcl3g2.pki.telesec.de/crt/GlobalRoot_Class_3.cer
            X509v3 Subject Key Identifier:
                F3:58:C5:3C:A9:74:4C:0D:AD:36:CC:00:6F:2C:C5:86:1E:38:71:02
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 89C82431C45C730113CF570FAF37FA4E62F9A57C8232A98CEDC7E6FF89326C43
    SPKI SHA256: 5FD46EB15CCD7587406F0711C142F0535C2EE44EBAE52C0CED28854B6F41E4E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.24
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: http://grcl3g2.pki.telesec.de/crt/GlobalRoot_Class_3.cer
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec PKS CA 4:PN

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 4:PN
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 010F
- SHA-256: DC68C2548BA1B23EE0D8D5502FF3EF6799C0C4B0099E8019020B4ED1341C2021
- SPKI SHA-256: 55C08F84AB1590BC804A13A605E82A67C70FAC7C2D9ABAC9AB3D6F5324CA4274
- Validity: 2009-03-30 to 2019-03-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pks.telesec.de/cps/cps.pdf, http://pks.telesec.de/cps/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 271 (0x10f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Mar 30 11:02:51 2009 GMT
            Not After : Mar 30 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-TeleSec Trust Center Services, CN = TeleSec PKS CA 4:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 1073741953 (0x40000081)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Subject Key Identifier:
                20:54:51:71:F0:32:DB:9B:DE:37:6C:1D:4F:1D:70:FE:76:21:32:51
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,c=DE?AuthorityRevocationList
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DC68C2548BA1B23EE0D8D5502FF3EF6799C0C4B0099E8019020B4ED1341C2021
    SPKI SHA256: 55C08F84AB1590BC804A13A605E82A67C70FAC7C2D9ABAC9AB3D6F5324CA4274
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### TeleSec PKS CA 5:PN

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 5:PN
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 0110
- SHA-256: 3D0FC08DA04AEF645B762034AEE6EBB0E09DA7915292D75D117B232953C9A3B0
- SPKI SHA-256: D4BB788B9C231DC625AC2BCD3085EA3E1BFD68A4B31532AB6B5C1DA5E6ACFBEE
- Validity: 2009-03-30 to 2019-03-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pks.telesec.de/cps/cps.pdf, http://pks.telesec.de/cps/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 272 (0x110)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Mar 30 11:07:20 2009 GMT
            Not After : Mar 30 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-TeleSec Trust Center Services, CN = TeleSec PKS CA 5:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 1073741953 (0x40000081)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Subject Key Identifier:
                B2:32:70:8C:9E:30:94:1D:8E:A4:7B:ED:0E:41:61:F0:54:A2:24:C8
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,c=DE?AuthorityRevocationList
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3D0FC08DA04AEF645B762034AEE6EBB0E09DA7915292D75D117B232953C9A3B0
    SPKI SHA256: D4BB788B9C231DC625AC2BCD3085EA3E1BFD68A4B31532AB6B5C1DA5E6ACFBEE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### TeleSec PKS CA 6:PN

- Subject: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-TeleSec Trust Center Services, commonName=TeleSec PKS CA 6:PN
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 0111
- SHA-256: 9CB9955AA4DD7C0F25AD4BBF30B0CFCF109C46C2BD80832A39F1216131ED415C
- SPKI SHA-256: 73F9E8F4DF1F2154525BA8927DCF47A93C0E7196BEDC78511B6C45D5D89E6454
- Validity: 2009-03-30 to 2019-03-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pks.telesec.de/cps/cps.pdf, http://pks.telesec.de/cps/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 273 (0x111)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Mar 30 11:10:55 2009 GMT
            Not After : Mar 30 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-TeleSec Trust Center Services, CN = TeleSec PKS CA 6:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 1073741953 (0x40000081)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Subject Key Identifier:
                93:94:2C:1D:AC:75:A7:DD:D4:71:24:49:7F:85:99:34:AF:57:58:79
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,c=DE?AuthorityRevocationList
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9CB9955AA4DD7C0F25AD4BBF30B0CFCF109C46C2BD80832A39F1216131ED415C
    SPKI SHA256: 73F9E8F4DF1F2154525BA8927DCF47A93C0E7196BEDC78511B6C45D5D89E6454
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### TeleSec PKS CA 7:PN

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=TeleSec PKS CA 7:PN
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 0113
- SHA-256: 6F6B88D9464CADA5AE34F7CCD871C006BC3ED06EBE3568D2B40865D775862FE9
- SPKI SHA-256: 5900508B1B3133B8B64F225E658983D98DCDDB97DEE3BC5A510DCF0E322B3024
- Validity: 2010-07-14 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://pks.telesec.de/cps/cps.pdf, http://pks.telesec.de/cps/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 275 (0x113)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jul 14 10:27:20 2010 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = Trust Center Deutsche Telekom, CN = TeleSec PKS CA 7:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 1073741953 (0x40000081)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                70:16:A6:38:94:1A:F9:A7:0E:EB:28:61:30:E5:34:61:2D:C9:01:49
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,c=DE?AuthorityRevocationList
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6F6B88D9464CADA5AE34F7CCD871C006BC3ED06EBE3568D2B40865D775862FE9
    SPKI SHA256: 5900508B1B3133B8B64F225E658983D98DCDDB97DEE3BC5A510DCF0E322B3024
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### TeleSec PKS CA 7:PN

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=Trust Center Deutsche Telekom, commonName=TeleSec PKS CA 7:PN
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: B6980167
- SHA-256: 10C6918C58ED94DD6A6B51588C401FA2C8EB4CC6D40F125FFAD41496128D7B58
- SPKI SHA-256: 5900508B1B3133B8B64F225E658983D98DCDDB97DEE3BC5A510DCF0E322B3024
- Validity: 2016-06-09 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.telesec.de/en/signaturecard/support/download-area/category/107-zertifizierungserklaerung-cps, https://www.telesec.de/en/signaturecard/support/download-area/category/107-zertifizierungserklaerung-cps
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202, http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3063415143 (0xb6980167)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Jun  9 10:06:12 2016 GMT
            Not After : Jul  9 23:59:59 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = Trust Center Deutsche Telekom, CN = TeleSec PKS CA 7:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 1073741953 (0x40000081)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                70:16:A6:38:94:1A:F9:A7:0E:EB:28:61:30:E5:34:61:2D:C9:01:49
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202,ou=T-TeleSec%20Trust%20Center,o=Deutsche%20Telekom%20AG,c=DE?AuthorityRevocationList
                Full Name:
                  URI:http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10C6918C58ED94DD6A6B51588C401FA2C8EB4CC6D40F125FFAD41496128D7B58
    SPKI SHA256: 5900508B1B3133B8B64F225E658983D98DCDDB97DEE3BC5A510DCF0E322B3024
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.telesec.de/cn=Deutsche%20Telekom%20Root%20CA%202, http://pki.telesec.de/rl/DT_ROOT_CA_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### TeleSec PKS CA 8

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, commonName=TeleSec PKS CA 8
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 341B47752B0FE27CE864557691F29A44
- SHA-256: D486BFA3F00D165EE2CF6270FDA7D00817E58CDA2DF4FA256E0F2EB122CF8F02
- SPKI SHA-256: 710E7E3FBC4535028F43F090238AD35BDB812509BC65372C1C63FB22C015B923
- Validity: 2019-03-20 to 2033-10-01
- Key: EC 256 prime256v1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://telesec.de/assets/downloads/PKI-Repository/PKS-CPS_07.00_EN.pdf, https://telesec.de/assets/downloads/PKI-Repository/PKS-CPS_07.00_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:1b:47:75:2b:0f:e2:7c:e8:64:55:76:91:f2:9a:44
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Mar 20 14:05:14 2019 GMT
            Not After : Oct  1 23:59:59 2033 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, CN = TeleSec PKS CA 8
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login
            X509v3 Subject Key Identifier:
                E0:52:EB:BC:B1:4F:CE:DE:04:4C:CC:03:38:EE:77:46:59:E9:BC:55
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
                CA Issuers - URI:http://pki.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.27
                  CPS: http://pks.telesec.de/cps/cps.pdf
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D486BFA3F00D165EE2CF6270FDA7D00817E58CDA2DF4FA256E0F2EB122CF8F02
    SPKI SHA256: 710E7E3FBC4535028F43F090238AD35BDB812509BC65372C1C63FB22C015B923
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.7879.13.27
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: http://pki.telesec.de/crt/T-TeleSec_GlobalRoot_Class_2.cer
- CRL Distribution Points: http://grcl2.crl.telesec.de/rl/T-TeleSec_GlobalRoot_Class_2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeleSec ServerPass Class 2 CA

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass Class 2 CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 2
- Serial: 7E39C7AD1DD9F043
- SHA-256: AC1EC556318E3EA70F8F04E03A0F2633BFE73992359A810145FFDF1A427396EE
- SPKI SHA-256: 7378DFF8BF152001509C924333A31F6F832D2352678554BC270647330263DBC3
- Validity: 2014-02-11 to 2024-02-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverpass.telesec.de/rl/ServerPass_Class_2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9095520468795519043 (0x7e39c7ad1dd9f043)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
        Validity
            Not Before: Feb 11 14:39:10 2014 GMT
            Not After : Feb 11 23:59:59 2024 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, ST = Nordrhein Westfalen, postalCode = 57250, L = Netphen, street = Untere Industriestr. 20, CN = TeleSec ServerPass Class 2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_2.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                94:C8:74:46:F5:3A:B4:46:48:26:F8:2B:CA:34:1E:56:26:04:12:00
            X509v3 Authority Key Identifier:
                BF:59:20:36:00:79:A0:A0:22:6B:8C:D5:F2:61:D2:B8:2C:CB:82:4A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AC1EC556318E3EA70F8F04E03A0F2633BFE73992359A810145FFDF1A427396EE
    SPKI SHA256: 7378DFF8BF152001509C924333A31F6F832D2352678554BC270647330263DBC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_2.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### TeleSec ServerPass DE-1

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=NRW, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass DE-1
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: 21B6777E8CBD0EA8
- SHA-256: 3C80FE6E6A70E12FAE2E7C7B289420F10A69E80DCC88847BB9836FF14A20F872
- SPKI SHA-256: F9DE698DEDECA25D9055C3E0296F9CA9A4D3390EC199610DFF204164F247053F
- Validity: 2013-03-01 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.telesec.de/serverpass/cps.html, http://www.telesec.de/serverpass/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- CRL DP: http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2429260434423746216 (0x21b6777e8cbd0ea8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Mar  1 13:58:29 2013 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, ST = NRW, postalCode = 57250, L = Netphen, street = Untere Industriestr. 20, CN = TeleSec ServerPass DE-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:4F:13:CE:36:67:84:CD:19:FC:A0:4F:19:8B:EF:15:54:01:32:1C
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.2
                  CPS: http://www.telesec.de/serverpass/cps.html
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp02.telesec.de/ocspr
                CA Issuers - URI:http://crl.serverpass.telesec.de/crt/DT_ROOT_CA_2.cer
                CA Issuers - URI:ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3C80FE6E6A70E12FAE2E7C7B289420F10A69E80DCC88847BB9836FF14A20F872
    SPKI SHA256: F9DE698DEDECA25D9055C3E0296F9CA9A4D3390EC199610DFF204164F247053F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- AIA CA Issuers: http://crl.serverpass.telesec.de/crt/DT_ROOT_CA_2.cer, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TeleSec ServerPass DE-2

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass DE-2
- Issuer: countryName=DE, organizationName=Deutsche Telekom AG, organizationalUnitName=T-TeleSec Trust Center, commonName=Deutsche Telekom Root CA 2
- Serial: C75E01582AC3BEE7
- SHA-256: 0E11763E429E422867F92D79BB140B86C1E46D50E0B2E8B9D5230E56A1F7FDB5
- SPKI SHA-256: C5031D7AD3AE8780579D57169BA53DAAB212EAB53445B308EE1363F6E554BD0D
- Validity: 2014-02-11 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.telesec.de/en/serverpass/cps.html, http://www.telesec.de/en/serverpass/cps.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- CRL DP: http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c7:5e:01:58:2a:c3:be:e7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
        Validity
            Not Before: Feb 11 14:30:17 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, ST = Nordrhein Westfalen, postalCode = 57250, L = Netphen, street = Untere Industriestr. 20, CN = TeleSec ServerPass DE-2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                54:04:29:6F:A2:93:C6:90:31:45:C0:3D:DE:2B:E2:0A:69:80:92:5F
            X509v3 Authority Key Identifier:
                31:C3:79:1B:BA:F5:53:D7:17:E0:89:7A:2D:17:6C:0A:B3:2B:9D:33
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.7879.13.2
                  CPS: http://www.telesec.de/serverpass/cps.html
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl
                Full Name:
                  URI:ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp02.telesec.de/ocspr
                CA Issuers - URI:http://crl.serverpass.telesec.de/crt/DT_ROOT_CA_2.cer
                CA Issuers - URI:ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202,OU=T-TeleSec%20Trust%20Center,O=Deutsche%20Telekom%20AG,C=DE?cACertificate
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0E11763E429E422867F92D79BB140B86C1E46D50E0B2E8B9D5230E56A1F7FDB5
    SPKI SHA256: C5031D7AD3AE8780579D57169BA53DAAB212EAB53445B308EE1363F6E554BD0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.7879.13.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp02.telesec.de/ocspr
- AIA CA Issuers: http://crl.serverpass.telesec.de/crt/DT_ROOT_CA_2.cer, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- CRL Distribution Points: http://crl.serverpass.telesec.de/rl/DT_ROOT_CA_2.crl, ldap://ldap.serverpass.telesec.de/CN=Deutsche%20Telekom%20Root%20CA%202
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TeleSec ServerPass Extended Validation Class 3 CA

- Subject: countryName=DE, organizationName=T-Systems International GmbH, organizationalUnitName=T-Systems Trust Center, stateOrProvinceName=Nordrhein Westfalen, postalCode=57250, localityName=Netphen, streetAddress=Untere Industriestr. 20, commonName=TeleSec ServerPass Extended Validation Class 3 CA
- Issuer: countryName=DE, organizationName=T-Systems Enterprise Services GmbH, organizationalUnitName=T-Systems Trust Center, commonName=T-TeleSec GlobalRoot Class 3
- Serial: 174D2CA6D6323C0E
- SHA-256: 8A0ADDAE4F2CF9D2C24D7A49EED5C86C8B1DF1C85BA73DE5C477CB14FA0D13E9
- SPKI SHA-256: 313B06A2E38A153E645B1BDD9823FFFA1E1057B4F38723D2BC65C9846FA0E5FD
- Validity: 2014-02-11 to 2024-02-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.serverpass.telesec.de/rl/ServerPass_EV_Class_3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.telesec.de/ocspr
- CRL DP: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1679047331148872718 (0x174d2ca6d6323c0e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 3
        Validity
            Not Before: Feb 11 14:44:50 2014 GMT
            Not After : Feb 11 23:59:59 2024 GMT
        Subject: C = DE, O = T-Systems International GmbH, OU = T-Systems Trust Center, ST = Nordrhein Westfalen, postalCode = 57250, L = Netphen, street = Untere Industriestr. 20, CN = TeleSec ServerPass Extended Validation Class 3 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.telesec.de/cps/cps.html
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.telesec.de/rl/GlobalRoot_Class_3.crl
                Full Name:
                  URI:ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203,OU=T-Systems%20Trust%20Center,O=T-Systems%20Enterprise%20Services%20GmbH,C=DE?AuthorityRevocationList
            Authority Information Access:
                OCSP - URI:http://ocsp.telesec.de/ocspr
            X509v3 Subject Key Identifier:
                30:2C:D5:4F:D2:08:D1:3D:E3:A7:82:92:82:37:89:6D:66:B9:0F:AF
            X509v3 Authority Key Identifier:
                B5:03:F7:76:3B:61:82:6A:12:AA:18:53:EB:03:21:94:BF:FE:CE:CA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8A0ADDAE4F2CF9D2C24D7A49EED5C86C8B1DF1C85BA73DE5C477CB14FA0D13E9
    SPKI SHA256: 313B06A2E38A153E645B1BDD9823FFFA1E1057B4F38723D2BC65C9846FA0E5FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.telesec.de/ocspr
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.telesec.de/rl/GlobalRoot_Class_3.crl, ldap://pki.telesec.de/CN=T-TeleSec%20GlobalRoot%20Class%203
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### TFH Berlin CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Technische Fachhochschule Berlin, organizationalUnitName=Hochschulrechenzentrum, commonName=TFH Berlin CA, emailAddress=pki@tfh-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B467300
- SHA-256: 4C121E69F9A502566A71B4F5F5F3389427179D1036671F6BDB08A6A2FEC50552
- SPKI SHA-256: CA22D0E4C121A200FE1A6986EB95F20033E12EFC3E32ED1D9E57F8FA2C85C6F6
- Validity: 2007-10-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 189166336 (0xb467300)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 30 09:12:18 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Technische Fachhochschule Berlin, OU = Hochschulrechenzentrum, CN = TFH Berlin CA, emailAddress = pki@tfh-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E5:8F:7F:E0:49:94:4E:07:53:EE:42:55:0A:6B:4C:26:57:EC:46:2C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tfh-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4C121E69F9A502566A71B4F5F5F3389427179D1036671F6BDB08A6A2FEC50552
    SPKI SHA256: CA22D0E4C121A200FE1A6986EB95F20033E12EFC3E32ED1D9E57F8FA2C85C6F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TFH Wildau CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Fachhochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TFH Wildau CA, emailAddress=pki@tfh-wildau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E5AEA16
- SHA-256: DC8775925E740CF64CC4D38B6FFC487A8F9CA7E3FAD98EB192464CF87694A84E
- SPKI SHA-256: 8D6A31253884BF9D73978C9F31359F322B72880A7168A64C35D4302A010BF820
- Validity: 2009-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 240839190 (0xe5aea16)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 10:46:30 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Wildau, O = Technische Fachhochschule Wildau, OU = Hochschulrechenzentrum, CN = TFH Wildau CA, emailAddress = pki@tfh-wildau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                27:B1:C5:FC:43:D5:F6:1A:8B:1F:65:E8:2F:69:2B:85:2E:1E:24:49
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tfh-wildau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DC8775925E740CF64CC4D38B6FFC487A8F9CA7E3FAD98EB192464CF87694A84E
    SPKI SHA256: 8D6A31253884BF9D73978C9F31359F322B72880A7168A64C35D4302A010BF820
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TH Wildau CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Hochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TH Wildau CA, emailAddress=pki@tfh-wildau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DD83393C
- SHA-256: 96D07AF45F3A7502E862AF63534C8814BBEEA9D85894B9856EE84BBBB3228A6E
- SPKI SHA-256: 5C3CC6ED8E1D1F7C7C8D13EDA22A57596104B5F19691DBB96D0B24FDEDCFF775
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399277525308 (0x17aff6dd83393c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:05 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Wildau, O = Technische Hochschule Wildau, OU = Hochschulrechenzentrum, CN = TH Wildau CA, emailAddress = pki@tfh-wildau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A3:04:64:B0:9F:00:38:47:27:A7:81:12:B2:3A:DD:64:2A:E8:E7:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tfh-wildau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 96D07AF45F3A7502E862AF63534C8814BBEEA9D85894B9856EE84BBBB3228A6E
    SPKI SHA256: 5C3CC6ED8E1D1F7C7C8D13EDA22A57596104B5F19691DBB96D0B24FDEDCFF775
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TH Wildau CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Wildau, organizationName=Technische Hochschule Wildau, organizationalUnitName=Hochschulrechenzentrum, commonName=TH Wildau CA, emailAddress=pki@tfh-wildau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1025EB62
- SHA-256: C81B89613F5E1515577EFA3C5CAC3E69FCAADA7BC58FC08D89F52A0EA6DB9AD6
- SPKI SHA-256: 5C3CC6ED8E1D1F7C7C8D13EDA22A57596104B5F19691DBB96D0B24FDEDCFF775
- Validity: 2010-06-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 270920546 (0x1025eb62)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  2 14:42:27 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Wildau, O = Technische Hochschule Wildau, OU = Hochschulrechenzentrum, CN = TH Wildau CA, emailAddress = pki@tfh-wildau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A3:04:64:B0:9F:00:38:47:27:A7:81:12:B2:3A:DD:64:2A:E8:E7:22
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tfh-wildau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C81B89613F5E1515577EFA3C5CAC3E69FCAADA7BC58FC08D89F52A0EA6DB9AD6
    SPKI SHA256: 5C3CC6ED8E1D1F7C7C8D13EDA22A57596104B5F19691DBB96D0B24FDEDCFF775
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ThH Friedensau CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Friedensau, organizationName=Theologische Hochschule Friedensau, commonName=ThH Friedensau CA, emailAddress=pki@thh-friedensau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 12E2FD1CEBAF20
- SHA-256: 85F737E105A49CDEB335871B8F5ADEF3924752145EEB7CF7B4448A012EEE5D95
- SPKI SHA-256: 94A19F81AEAFFCB6074E6F9E4C61AF8C64E8C087286A7385CD27A85D0D84BE82
- Validity: 2011-11-16 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5316126320602912 (0x12e2fd1cebaf20)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov 16 09:17:00 2011 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Friedensau, O = Theologische Hochschule Friedensau, CN = ThH Friedensau CA, emailAddress = pki@thh-friedensau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                99:BA:EC:31:DD:59:C2:FD:58:99:53:EB:90:45:64:97:96:5D:43:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@thh-friedensau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 85F737E105A49CDEB335871B8F5ADEF3924752145EEB7CF7B4448A012EEE5D95
    SPKI SHA256: 94A19F81AEAFFCB6074E6F9E4C61AF8C64E8C087286A7385CD27A85D0D84BE82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ThH Friedensau CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Friedensau, organizationName=Theologische Hochschule Friedensau, commonName=ThH Friedensau CA, emailAddress=pki@thh-friedensau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6FBE2E4F7
- SHA-256: 162FCD3C189069D867FEAD740768E4933F18DFFC72A3DE5369AFB92C7165166F
- SPKI SHA-256: 94A19F81AEAFFCB6074E6F9E4C61AF8C64E8C087286A7385CD27A85D0D84BE82
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399787111671 (0x17aff6fbe2e4f7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Friedensau, O = Theologische Hochschule Friedensau, CN = ThH Friedensau CA, emailAddress = pki@thh-friedensau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                99:BA:EC:31:DD:59:C2:FD:58:99:53:EB:90:45:64:97:96:5D:43:A5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@thh-friedensau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 162FCD3C189069D867FEAD740768E4933F18DFFC72A3DE5369AFB92C7165166F
    SPKI SHA256: 94A19F81AEAFFCB6074E6F9E4C61AF8C64E8C087286A7385CD27A85D0D84BE82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Thuenen-Institut CA - G01

- Subject: countryName=DE, organizationName=Thuenen-Institut, commonName=Thuenen-Institut CA - G01, emailAddress=ca@ti.bund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 177D94D5B4EA4D
- SHA-256: DE3656202DAC034AC88CFF0698A4F17DAE5D8B2159A0FA75BFB1769F5223B6EC
- SPKI SHA-256: 1C2CBA64BA8F8CF1E7277C0C57AAD5EA23A61E7B71D1D3BB5AC1FCCC5B0932BF
- Validity: 2014-04-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6612002658380365 (0x177d94d5b4ea4d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 28 08:54:29 2014 GMT
            Not After : Jul  9 00:00:00 2019 GMT
        Subject: C = DE, O = Thuenen-Institut, CN = Thuenen-Institut CA - G01, emailAddress = ca@ti.bund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C6:7E:82:9E:D7:8A:F2:79:37:0F:A8:11:13:95:FC:8D:13:92:9B:35
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@ti.bund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE3656202DAC034AC88CFF0698A4F17DAE5D8B2159A0FA75BFB1769F5223B6EC
    SPKI SHA256: 1C2CBA64BA8F8CF1E7277C0C57AAD5EA23A61E7B71D1D3BB5AC1FCCC5B0932BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TiHo Hannover CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Stiftung Tieraerztliche Hochschule Hannover, commonName=TiHo Hannover CA, emailAddress=ca@tiho-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B05C850
- SHA-256: 03355E8E640C3CB98710249503D3BE5569AD94E1AED73C797D617996696EE25B
- SPKI SHA-256: 15326D98C9132239D24B6EE2AD49CD7B4136CD48894354B93F48C701A4D25009
- Validity: 2007-09-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 184928336 (0xb05c850)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 11 07:58:58 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Stiftung Tieraerztliche Hochschule Hannover, CN = TiHo Hannover CA, emailAddress = ca@tiho-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:85:70:72:C8:02:35:3B:35:BD:9A:8F:F2:A4:71:BE:A5:4D:95:7A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tiho-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 03355E8E640C3CB98710249503D3BE5569AD94E1AED73C797D617996696EE25B
    SPKI SHA256: 15326D98C9132239D24B6EE2AD49CD7B4136CD48894354B93F48C701A4D25009
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TiHo Hannover CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Hannover, organizationName=Stiftung Tieraerztliche Hochschule Hannover, commonName=TiHo Hannover CA, emailAddress=ca@tiho-hannover.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248F2C469B
- SHA-256: 1878579FEBCEDB39ABD5F0AA8315B85C118B8CC4CE3362A2CA5982D045851DAA
- SPKI SHA-256: 15326D98C9132239D24B6EE2AD49CD7B4136CD48894354B93F48C701A4D25009
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401392166555 (0x17a4248f2c469b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Hannover, O = Stiftung Tieraerztliche Hochschule Hannover, CN = TiHo Hannover CA, emailAddress = ca@tiho-hannover.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:85:70:72:C8:02:35:3B:35:BD:9A:8F:F2:A4:71:BE:A5:4D:95:7A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tiho-hannover.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1878579FEBCEDB39ABD5F0AA8315B85C118B8CC4CE3362A2CA5982D045851DAA
    SPKI SHA256: 15326D98C9132239D24B6EE2AD49CD7B4136CD48894354B93F48C701A4D25009
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Bergakademie Freiberg CA (TUBAF-CA)

- Subject: countryName=DE, organizationName=Technische Universitaet Bergakademie Freiberg, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress=tubaf-ca@tu-freiberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AB6F512
- SHA-256: 583B0CAB472D8E24987EB23900913DC07DC66116A72CF07FBC629A6902C28297
- SPKI SHA-256: 9112324690E3DF88264A817822A87CCEF15476E4B3C38BC76E1B897F5D9B4AEF
- Validity: 2007-07-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179762450 (0xab6f512)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 13 13:00:52 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Bergakademie Freiberg, OU = Universitaetsrechenzentrum, CN = TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress = tubaf-ca@tu-freiberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9F:51:90:F7:98:0A:F4:3F:15:0F:0E:B6:0A:A9:7F:B7:35:1D:1D:2D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tubaf-ca@tu-freiberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 583B0CAB472D8E24987EB23900913DC07DC66116A72CF07FBC629A6902C28297
    SPKI SHA256: 9112324690E3DF88264A817822A87CCEF15476E4B3C38BC76E1B897F5D9B4AEF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Bergakademie Freiberg CA (TUBAF-CA)

- Subject: countryName=DE, organizationName=Technische Universitaet Bergakademie Freiberg, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress=tubaf-ca@tu-freiberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248576459D
- SHA-256: EE9D0815D0D1C206605BBC0320E05C277E68887C156EA083D6A4D8116EBC333B
- SPKI SHA-256: 9112324690E3DF88264A817822A87CCEF15476E4B3C38BC76E1B897F5D9B4AEF
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401229243805 (0x17a4248576459d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:41 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Bergakademie Freiberg, OU = Universitaetsrechenzentrum, CN = TU Bergakademie Freiberg CA (TUBAF-CA), emailAddress = tubaf-ca@tu-freiberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9F:51:90:F7:98:0A:F4:3F:15:0F:0E:B6:0A:A9:7F:B7:35:1D:1D:2D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tubaf-ca@tu-freiberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE9D0815D0D1C206605BBC0320E05C277E68887C156EA083D6A4D8116EBC333B
    SPKI SHA256: 9112324690E3DF88264A817822A87CCEF15476E4B3C38BC76E1B897F5D9B4AEF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Chemnitz Certification Authority - TUC/URZ CA G3

- Subject: countryName=DE, organizationName=Technische Universitaet Chemnitz, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress=ca@tu-chemnitz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09D7EE77
- SHA-256: C2B1F3DF085E7D56F965DE4E17D3541ED151E678EB45DA1702FA6A4197E0D73B
- SPKI SHA-256: 9171CC872E9B1C9C5E492B46D1B73764F08B867A69A84323A1EC5EB4D6FBA3E0
- Validity: 2007-01-25 to 2019-01-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165146231 (0x9d7ee77)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 25 08:57:12 2007 GMT
            Not After : Jan 15 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Chemnitz, OU = Universitaetsrechenzentrum, CN = TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress = ca@tu-chemnitz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:DA:B8:F2:47:DE:99:24:7D:67:40:89:27:67:71:0D:63:D8:A3:8E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tu-chemnitz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C2B1F3DF085E7D56F965DE4E17D3541ED151E678EB45DA1702FA6A4197E0D73B
    SPKI SHA256: 9171CC872E9B1C9C5E492B46D1B73764F08B867A69A84323A1EC5EB4D6FBA3E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Chemnitz Certification Authority - TUC/URZ CA G3

- Subject: countryName=DE, organizationName=Technische Universitaet Chemnitz, organizationalUnitName=Universitaetsrechenzentrum, commonName=TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress=ca@tu-chemnitz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060CE48D5DE
- SHA-256: 7402E436A68CD91662251B14D97831E3CBC3BD1217D98D27FB804F0385B84B16
- SPKI SHA-256: 9171CC872E9B1C9C5E492B46D1B73764F08B867A69A84323A1EC5EB4D6FBA3E0
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632669916485086 (0x179060ce48d5de)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:34 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Chemnitz, OU = Universitaetsrechenzentrum, CN = TU Chemnitz Certification Authority - TUC/URZ CA G3, emailAddress = ca@tu-chemnitz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:DA:B8:F2:47:DE:99:24:7D:67:40:89:27:67:71:0D:63:D8:A3:8E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tu-chemnitz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7402E436A68CD91662251B14D97831E3CBC3BD1217D98D27FB804F0385B84B16
    SPKI SHA256: 9171CC872E9B1C9C5E492B46D1B73764F08B867A69A84323A1EC5EB4D6FBA3E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Clausthal CA - G02

- Subject: countryName=DE, organizationName=Technische Universitaet Clausthal, organizationalUnitName=Rechenzentrum, commonName=TU Clausthal CA - G02, emailAddress=pki@rz.tu-clausthal.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB196
- SHA-256: 50426C6E28A6029F43B65EC64FFCBAA824A1AE5628DE610402A55A183DF6C371
- SPKI SHA-256: 56962A6BF90FB5A76BD51BD561C504E114439B9EF3719EEC702A4813C28B281C
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604054 (0xa0cb196)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:36 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Clausthal, OU = Rechenzentrum, CN = TU Clausthal CA - G02, emailAddress = pki@rz.tu-clausthal.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:FC:92:B7:E7:ED:F3:1F:35:55:5B:C9:43:DF:50:B3:5E:F4:10:25
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rz.tu-clausthal.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 50426C6E28A6029F43B65EC64FFCBAA824A1AE5628DE610402A55A183DF6C371
    SPKI SHA256: 56962A6BF90FB5A76BD51BD561C504E114439B9EF3719EEC702A4813C28B281C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Clausthal CA - G02

- Subject: countryName=DE, organizationName=Technische Universitaet Clausthal, organizationalUnitName=Rechenzentrum, commonName=TU Clausthal CA - G02, emailAddress=pki@rz.tu-clausthal.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F0365B6F
- SHA-256: 017C1E0FF3AB56191FA41F9D6A92A4781C1ED96424361CC7717898F92D769280
- SPKI SHA-256: 56962A6BF90FB5A76BD51BD561C504E114439B9EF3719EEC702A4813C28B281C
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670485699439 (0x179060f0365b6f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Clausthal, OU = Rechenzentrum, CN = TU Clausthal CA - G02, emailAddress = pki@rz.tu-clausthal.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                62:FC:92:B7:E7:ED:F3:1F:35:55:5B:C9:43:DF:50:B3:5E:F4:10:25
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rz.tu-clausthal.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 017C1E0FF3AB56191FA41F9D6A92A4781C1ED96424361CC7717898F92D769280
    SPKI SHA256: 56962A6BF90FB5A76BD51BD561C504E114439B9EF3719EEC702A4813C28B281C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Dortmund CA - G01

- Subject: countryName=DE, organizationName=Technische Universitaet Dortmund, organizationalUnitName=ITMC, commonName=TU Dortmund CA - G01, emailAddress=ca@pki.tu-dortmund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424BE124001
- SHA-256: 842660EDA2BBB9C3D8442930481BC70A754FD8C02ADFBF17453B4C208AC29997
- SPKI SHA-256: 3153252D54AE3C2B2304FA512434B9F14418FF38E95C61E6D78DB55D1014EEA6
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402178990081 (0x17a424be124001)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dortmund, OU = ITMC, CN = TU Dortmund CA - G01, emailAddress = ca@pki.tu-dortmund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FB:B1:5C:9B:6D:E8:25:E4:A9:AA:32:44:EF:02:83:45:0D:E6:06:EC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@pki.tu-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 842660EDA2BBB9C3D8442930481BC70A754FD8C02ADFBF17453B4C208AC29997
    SPKI SHA256: 3153252D54AE3C2B2304FA512434B9F14418FF38E95C61E6D78DB55D1014EEA6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Dortmund CA - G01

- Subject: countryName=DE, organizationName=Technische Universitaet Dortmund, organizationalUnitName=ITMC, commonName=TU Dortmund CA - G01, emailAddress=ca@pki.tu-dortmund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C438CD5
- SHA-256: EA24E499998D69C7EE5EADCCB2FFC8F22D1622E0BB94A38BECCDC4A6C1D9CECE
- SPKI SHA-256: 3153252D54AE3C2B2304FA512434B9F14418FF38E95C61E6D78DB55D1014EEA6
- Validity: 2008-05-09 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 205753557 (0xc438cd5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May  9 08:45:58 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dortmund, OU = ITMC, CN = TU Dortmund CA - G01, emailAddress = ca@pki.tu-dortmund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FB:B1:5C:9B:6D:E8:25:E4:A9:AA:32:44:EF:02:83:45:0D:E6:06:EC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@pki.tu-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EA24E499998D69C7EE5EADCCB2FFC8F22D1622E0BB94A38BECCDC4A6C1D9CECE
    SPKI SHA256: 3153252D54AE3C2B2304FA512434B9F14418FF38E95C61E6D78DB55D1014EEA6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Dortmund Chipcard CA

- Subject: countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA, emailAddress=chipcard-ca@pki.tu-dortmund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CB7C9C4
- SHA-256: 43820ADB929F09F5D95E4101783F8FB16ABCEBC878F6A06CF1FF2AAB8BED48B1
- SPKI SHA-256: 4CEDA8275E9BD4B148C1CB684BC0348E1E50D2958878975331945CDD8593AE0B
- Validity: 2008-08-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 213371332 (0xcb7c9c4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug  5 12:48:53 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dortmund, CN = TU Dortmund Chipcard CA, emailAddress = chipcard-ca@pki.tu-dortmund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9B:FF:54:37:B2:6E:AC:42:D2:80:93:44:E4:58:98:62:5E:79:76:8D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:chipcard-ca@pki.tu-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 43820ADB929F09F5D95E4101783F8FB16ABCEBC878F6A06CF1FF2AAB8BED48B1
    SPKI SHA256: 4CEDA8275E9BD4B148C1CB684BC0348E1E50D2958878975331945CDD8593AE0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Dortmund Chipcard CA

- Subject: countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA, emailAddress=chipcard-ca@pki.tu-dortmund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 18D468BF00A169
- SHA-256: 2D7DEED4849CA5D29021F423B19B2234369D49BDA4AE9FAAC6CD1AD5B4D5F741
- SPKI SHA-256: 4CEDA8275E9BD4B148C1CB684BC0348E1E50D2958878975331945CDD8593AE0B
- Validity: 2015-01-13 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6988945787232617 (0x18d468bf00a169)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 13 09:53:52 2015 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dortmund, CN = TU Dortmund Chipcard CA, emailAddress = chipcard-ca@pki.tu-dortmund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                9B:FF:54:37:B2:6E:AC:42:D2:80:93:44:E4:58:98:62:5E:79:76:8D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:chipcard-ca@pki.tu-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2D7DEED4849CA5D29021F423B19B2234369D49BDA4AE9FAAC6CD1AD5B4D5F741
    SPKI SHA256: 4CEDA8275E9BD4B148C1CB684BC0348E1E50D2958878975331945CDD8593AE0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Dortmund Chipcard CA 2

- Subject: countryName=DE, organizationName=Technische Universitaet Dortmund, commonName=TU Dortmund Chipcard CA 2
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B809DBAC8F194EBDD5D27A8
- SHA-256: E121C1694DA737C17B86448AEDC614EEBD7946A7B4B91FB30025B636070239EA
- SPKI SHA-256: FA9E2B0008186C73DBC16AEBFC194DA33AF36F8187B79052B99C2779A0D194EB
- Validity: 2016-06-15 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/tu-dortmund-chipcard-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:80:9d:ba:c8:f1:94:eb:dd:5d:27:a8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Jun 15 09:30:18 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, O = Technische Universitaet Dortmund, CN = TU Dortmund Chipcard CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                27:71:46:54:69:53:6F:62:26:FC:DD:55:AD:9F:F0:FA:5A:EF:C7:F5
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E121C1694DA737C17B86448AEDC614EEBD7946A7B4B91FB30025B636070239EA
    SPKI SHA256: FA9E2B0008186C73DBC16AEBFC194DA33AF36F8187B79052B99C2779A0D194EB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TU Dresden CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen, localityName=Dresden, organizationName=Technische Universitaet Dresden, commonName=TU Dresden CA
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1C6E34243F3AD82C1BCC9135
- SHA-256: E1B295E1465C24E0951EC0B90FBF7DA30B678E9E9CE4417DFFE9F34042DF4386
- SPKI SHA-256: 75CFB9C27D90AFEDF38288ABF124075A3EC77CD337DB5313CA6E0449BE46B47D
- Validity: 2016-12-12 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/tu-dresden-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:6e:34:24:3f:3a:d8:2c:1b:cc:91:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Dec 12 14:39:16 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, ST = Sachsen, L = Dresden, O = Technische Universitaet Dresden, CN = TU Dresden CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                52:FE:BE:B7:24:C2:1B:0A:1D:46:52:8E:44:24:2A:F4:48:40:3D:01
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E1B295E1465C24E0951EC0B90FBF7DA30B678E9E9CE4417DFFE9F34042DF4386
    SPKI SHA256: 75CFB9C27D90AFEDF38288ABF124075A3EC77CD337DB5313CA6E0449BE46B47D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TU Dresden CA - G02

- Subject: countryName=DE, organizationName=Technische Universitaet Dresden, organizationalUnitName=ZIH, commonName=TU Dresden CA - G02, emailAddress=pki@tu-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42479685C8E
- SHA-256: C47350F8484A2B15FB2CB9BAE605038BCC4D0E289C983F9ABD47B66C22E317EE
- SPKI SHA-256: 0179881181E9958A8DD558F58683B5A74112EEF8F135E4047A6F3DD9F05CDB01
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401027005582 (0x17a42479685c8e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:29 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dresden, OU = ZIH, CN = TU Dresden CA - G02, emailAddress = pki@tu-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C5:2B:53:93:17:83:C9:F5:46:42:ED:43:6A:DF:B6:80:A6:47:F2:E0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C47350F8484A2B15FB2CB9BAE605038BCC4D0E289C983F9ABD47B66C22E317EE
    SPKI SHA256: 0179881181E9958A8DD558F58683B5A74112EEF8F135E4047A6F3DD9F05CDB01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Dresden CA - G02

- Subject: countryName=DE, organizationName=Technische Universitaet Dresden, organizationalUnitName=ZIH, commonName=TU Dresden CA - G02, emailAddress=pki@tu-dresden.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A97242D
- SHA-256: 248E02781167C2B200D5EB7DDE44D3CD06656D470D9F950EFCA29D41870FF1FC
- SPKI SHA-256: 0179881181E9958A8DD558F58683B5A74112EEF8F135E4047A6F3DD9F05CDB01
- Validity: 2007-06-19 to 2019-06-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677357 (0xa97242d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:49:18 2007 GMT
            Not After : Jun 18 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Dresden, OU = ZIH, CN = TU Dresden CA - G02, emailAddress = pki@tu-dresden.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C5:2B:53:93:17:83:C9:F5:46:42:ED:43:6A:DF:B6:80:A6:47:F2:E0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-dresden.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 248E02781167C2B200D5EB7DDE44D3CD06656D470D9F950EFCA29D41870FF1FC
    SPKI SHA256: 0179881181E9958A8DD558F58683B5A74112EEF8F135E4047A6F3DD9F05CDB01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Ilmenau CA

- Subject: countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA, emailAddress=pki@tu-ilmenau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6A5C9609C
- SHA-256: 3B4D612FB8E4F376D44AA3C775BC05FFA6F49FD875E9DF59A22D7CAA47EBF6C7
- SPKI SHA-256: 5770709D6A199B3421F574CC4529D1D6A079524A29B12FF7D4F4EA54F7E0233D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398342598812 (0x17aff6a5c9609c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Ilmenau, CN = TU Ilmenau CA, emailAddress = pki@tu-ilmenau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D4:C3:45:12:8A:A9:EB:4D:A5:CA:56:7F:69:D1:C2:68:74:63:FD:01
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-ilmenau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B4D612FB8E4F376D44AA3C775BC05FFA6F49FD875E9DF59A22D7CAA47EBF6C7
    SPKI SHA256: 5770709D6A199B3421F574CC4529D1D6A079524A29B12FF7D4F4EA54F7E0233D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TU Ilmenau CA

- Subject: countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA, emailAddress=pki@tu-ilmenau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DBA02D4
- SHA-256: 1D47BE8333EEDE044A2B971BE83CC690F22CF32822848FA2CA36DE05CA8A6D15
- SPKI SHA-256: 5770709D6A199B3421F574CC4529D1D6A079524A29B12FF7D4F4EA54F7E0233D
- Validity: 2009-02-17 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 230294228 (0xdba02d4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 17 09:37:09 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Ilmenau, CN = TU Ilmenau CA, emailAddress = pki@tu-ilmenau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D4:C3:45:12:8A:A9:EB:4D:A5:CA:56:7F:69:D1:C2:68:74:63:FD:01
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@tu-ilmenau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1D47BE8333EEDE044A2B971BE83CC690F22CF32822848FA2CA36DE05CA8A6D15
    SPKI SHA256: 5770709D6A199B3421F574CC4529D1D6A079524A29B12FF7D4F4EA54F7E0233D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TU Ilmenau CA G2

- Subject: countryName=DE, organizationName=Technische Universitaet Ilmenau, commonName=TU Ilmenau CA G2
- Issuer: countryName=DE, organizationName=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., organizationalUnitName=DFN-PKI, commonName=DFN-Verein Certification Authority 2
- Serial: 1B9DCD8A84F6517B4758CCF4
- SHA-256: 1A5CCD714ABD7C7AF52A0FA946BC9C8F8696BCBF227D81339430E5D3394ECC97
- SPKI SHA-256: E925DF58BFFFFC77C82E4B010800165D60100A5515B0479297A2E0F23995956A
- Validity: 2016-07-07 to 2031-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cdp1.pca.dfn.de/tu-ilmenau-g2-ca/pub/crl/cacrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:9d:cd:8a:84:f6:51:7b:47:58:cc:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
        Validity
            Not Before: Jul  7 12:50:02 2016 GMT
            Not After : Feb 22 23:59:59 2031 GMT
        Subject: C = DE, O = Technische Universitaet Ilmenau, CN = TU Ilmenau CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                64:D1:62:5B:6A:DE:E3:5D:19:93:7B:A2:6B:A7:21:34:E9:06:DF:21
            X509v3 Authority Key Identifier:
                93:E3:D8:32:26:DA:D5:F1:4A:A5:91:4A:E0:EA:4B:E2:A2:0C:CF:E1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1A5CCD714ABD7C7AF52A0FA946BC9C8F8696BCBF227D81339430E5D3394ECC97
    SPKI SHA256: E925DF58BFFFFC77C82E4B010800165D60100A5515B0479297A2E0F23995956A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TUB-CA

- Subject: countryName=DE, organizationName=Technische Universitaet Berlin, commonName=TUB-CA, emailAddress=ca@TU-Berlin.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4250C370ED7
- SHA-256: 00FB6E11A84FC8424A4341304F9ECD3EDC30D80894E0FD7B22903B911EC4EE24
- SPKI SHA-256: 32C220C58DBFBD07F7C9AD80818312A828B8A9490A9B6CBF7134DEF4C2912645
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654403490025175 (0x17a4250c370ed7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:56 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Berlin, CN = TUB-CA, emailAddress = ca@TU-Berlin.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                23:32:42:9E:FE:62:42:4E:FB:4E:D0:17:9B:78:E7:ED:8A:8C:3E:78
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@TU-Berlin.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 00FB6E11A84FC8424A4341304F9ECD3EDC30D80894E0FD7B22903B911EC4EE24
    SPKI SHA256: 32C220C58DBFBD07F7C9AD80818312A828B8A9490A9B6CBF7134DEF4C2912645
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TUB-CA

- Subject: countryName=DE, organizationName=Technische Universitaet Berlin, commonName=TUB-CA, emailAddress=ca@TU-Berlin.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B20663B
- SHA-256: 9A890748C852AFD10E703D2A13074AFC5CE7D99B6851EFCEB2DFB863937C796C
- SPKI SHA-256: 32C220C58DBFBD07F7C9AD80818312A828B8A9490A9B6CBF7134DEF4C2912645
- Validity: 2007-10-01 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 186672699 (0xb20663b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct  1 12:31:40 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Berlin, CN = TUB-CA, emailAddress = ca@TU-Berlin.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                23:32:42:9E:FE:62:42:4E:FB:4E:D0:17:9B:78:E7:ED:8A:8C:3E:78
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@TU-Berlin.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9A890748C852AFD10E703D2A13074AFC5CE7D99B6851EFCEB2DFB863937C796C
    SPKI SHA256: 32C220C58DBFBD07F7C9AD80818312A828B8A9490A9B6CBF7134DEF4C2912645
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TUD CA G01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA G01, emailAddress=tud-ca@hrz.tu-darmstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248095F705
- SHA-256: A97475870011F8459C71DBBB1C643A85062CDD5F29CFF6BDF1CFE32178690B8D
- SPKI SHA-256: A5D4DB66F31E834700A32FA986D9F1D2135ECBDA75600090CD1F9BC9544A9148
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401147434757 (0x17a4248095f705)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Darmstadt, O = Technische Universitaet Darmstadt, CN = TUD CA G01, emailAddress = tud-ca@hrz.tu-darmstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BA:37:C8:A4:74:C6:34:3E:91:27:9F:55:1B:5E:F8:1B:D9:A8:E4:41
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tud-ca@hrz.tu-darmstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A97475870011F8459C71DBBB1C643A85062CDD5F29CFF6BDF1CFE32178690B8D
    SPKI SHA256: A5D4DB66F31E834700A32FA986D9F1D2135ECBDA75600090CD1F9BC9544A9148
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TUD CA G01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA G01, emailAddress=tud-ca@hrz.tu-darmstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AA9DB1E
- SHA-256: 2AD60969BC8407B6406D087CB199400846F2882583BECBCCF0A1D22FE3F83FFB
- SPKI SHA-256: A5D4DB66F31E834700A32FA986D9F1D2135ECBDA75600090CD1F9BC9544A9148
- Validity: 2007-07-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 178903838 (0xaa9db1e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul  3 14:30:40 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Darmstadt, O = Technische Universitaet Darmstadt, CN = TUD CA G01, emailAddress = tud-ca@hrz.tu-darmstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BA:37:C8:A4:74:C6:34:3E:91:27:9F:55:1B:5E:F8:1B:D9:A8:E4:41
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tud-ca@hrz.tu-darmstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2AD60969BC8407B6406D087CB199400846F2882583BECBCCF0A1D22FE3F83FFB
    SPKI SHA256: A5D4DB66F31E834700A32FA986D9F1D2135ECBDA75600090CD1F9BC9544A9148
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TUD CA P01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA P01, emailAddress=tud-ca@hrz.tu-darmstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 10BC2C04
- SHA-256: 7909B7CB6A5ED95758C2EF47D51EEF98136D60458372986121E59B7A7C7CC409
- SPKI SHA-256: 8F36B4F2E79B0CC82262DF019FFA2E41DB8C993B0F0343CD23213940412D89B2
- Validity: 2010-09-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 280767492 (0x10bc2c04)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 24 13:58:12 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Darmstadt, O = Technische Universitaet Darmstadt, CN = TUD CA P01, emailAddress = tud-ca@hrz.tu-darmstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                93:FD:09:A2:59:87:AC:38:14:E0:B6:FE:5D:67:54:A6:81:8F:12:6C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tud-ca@hrz.tu-darmstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7909B7CB6A5ED95758C2EF47D51EEF98136D60458372986121E59B7A7C7CC409
    SPKI SHA256: 8F36B4F2E79B0CC82262DF019FFA2E41DB8C993B0F0343CD23213940412D89B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TUD CA P01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Darmstadt, organizationName=Technische Universitaet Darmstadt, commonName=TUD CA P01, emailAddress=tud-ca@hrz.tu-darmstadt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E6D7C349
- SHA-256: D1F7BE468E0B3F04533860118388C8178EF9EB4D50E6204E728F529660E8F399
- SPKI SHA-256: 8F36B4F2E79B0CC82262DF019FFA2E41DB8C993B0F0343CD23213940412D89B2
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399434060617 (0x17aff6e6d7c349)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:14 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Darmstadt, O = Technische Universitaet Darmstadt, CN = TUD CA P01, emailAddress = tud-ca@hrz.tu-darmstadt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                93:FD:09:A2:59:87:AC:38:14:E0:B6:FE:5D:67:54:A6:81:8F:12:6C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tud-ca@hrz.tu-darmstadt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1F7BE468E0B3F04533860118388C8178EF9EB4D50E6204E728F529660E8F399
    SPKI SHA256: 8F36B4F2E79B0CC82262DF019FFA2E41DB8C993B0F0343CD23213940412D89B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TUHH CA in DFN-PKI Global - G01

- Subject: countryName=DE, organizationName=Technische Universitaet Hamburg-Harburg, organizationalUnitName=Rechenzentrum, commonName=TUHH CA in DFN-PKI Global - G01, emailAddress=tuhh-dfnpki-ra@tu-harburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CE07469
- SHA-256: D57A46AC0681835DA2EE1B805522C1A2705FCD88960DAA0339CEFD3BEF48AD1B
- SPKI SHA-256: 613D2E25F16D9C5955D01EC2C3A11992F1014B818F1630626D0237C95D79178A
- Validity: 2008-09-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 216036457 (0xce07469)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep  5 09:07:38 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Hamburg-Harburg, OU = Rechenzentrum, CN = TUHH CA in DFN-PKI Global - G01, emailAddress = tuhh-dfnpki-ra@tu-harburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E9:2C:A8:82:C1:B7:CC:B6:D4:AA:40:0E:4F:A1:1C:21:A9:E6:D9:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tuhh-dfnpki-ra@tu-harburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D57A46AC0681835DA2EE1B805522C1A2705FCD88960DAA0339CEFD3BEF48AD1B
    SPKI SHA256: 613D2E25F16D9C5955D01EC2C3A11992F1014B818F1630626D0237C95D79178A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TUHH CA in DFN-PKI Global - G01

- Subject: countryName=DE, organizationName=Technische Universitaet Hamburg-Harburg, organizationalUnitName=Rechenzentrum, commonName=TUHH CA in DFN-PKI Global - G01, emailAddress=tuhh-dfnpki-ra@tu-harburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF694F815DB
- SHA-256: FEA8374FA0D2A4CDE96906209242CF0CE6F74B39D1E67B04D5222F9AF18DC47C
- SPKI SHA-256: 613D2E25F16D9C5955D01EC2C3A11992F1014B818F1630626D0237C95D79178A
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398060447195 (0x17aff694f815db)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Hamburg-Harburg, OU = Rechenzentrum, CN = TUHH CA in DFN-PKI Global - G01, emailAddress = tuhh-dfnpki-ra@tu-harburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E9:2C:A8:82:C1:B7:CC:B6:D4:AA:40:0E:4F:A1:1C:21:A9:E6:D9:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:tuhh-dfnpki-ra@tu-harburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FEA8374FA0D2A4CDE96906209242CF0CE6F74B39D1E67B04D5222F9AF18DC47C
    SPKI SHA256: 613D2E25F16D9C5955D01EC2C3A11992F1014B818F1630626D0237C95D79178A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TuTech Innovation GmbH

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=TuTech Innovation GmbH, commonName=TuTech Innovation GmbH, emailAddress=ca@tutech.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6976D4D6B
- SHA-256: EC7784C623F68D61C1584D6228DB0EC72C2110C6E4B13405E8C0DA07BCFC1B95
- SPKI SHA-256: 9DD17E9E38D234C3AAD37BED2F94D3E002FA1FCA61971BFF1B7394EAA84BB14D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398101683563 (0x17aff6976d4d6b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = TuTech Innovation GmbH, CN = TuTech Innovation GmbH, emailAddress = ca@tutech.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9A:68:6C:39:E9:C3:08:6B:15:79:38:ED:40:A1:F4:2D:3C:4F:B7:9D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tutech.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EC7784C623F68D61C1584D6228DB0EC72C2110C6E4B13405E8C0DA07BCFC1B95
    SPKI SHA256: 9DD17E9E38D234C3AAD37BED2F94D3E002FA1FCA61971BFF1B7394EAA84BB14D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TuTech Innovation GmbH

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=TuTech Innovation GmbH, commonName=TuTech Innovation GmbH, emailAddress=ca@tutech.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CE70FAB
- SHA-256: FE42F4A7019F1385980FACAD9D8EC6B547C693933331E094800FC73B16D8954C
- SPKI SHA-256: 9DD17E9E38D234C3AAD37BED2F94D3E002FA1FCA61971BFF1B7394EAA84BB14D
- Validity: 2008-09-10 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 216469419 (0xce70fab)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 10 09:23:40 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = TuTech Innovation GmbH, CN = TuTech Innovation GmbH, emailAddress = ca@tutech.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9A:68:6C:39:E9:C3:08:6B:15:79:38:ED:40:A1:F4:2D:3C:4F:B7:9D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@tutech.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FE42F4A7019F1385980FACAD9D8EC6B547C693933331E094800FC73B16D8954C
    SPKI SHA256: 9DD17E9E38D234C3AAD37BED2F94D3E002FA1FCA61971BFF1B7394EAA84BB14D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UAUX-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Augsburg, organizationName=Universitaet Augsburg, organizationalUnitName=Rechenzentrum, commonName=UAUX-CA, emailAddress=ca-admin@rz.uni-augsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424E2EC9143
- SHA-256: EB0DEBFA11BBEA0B7DB860F8837F4EC34FE2818960033CC77D2660A56E21EF17
- SPKI SHA-256: F7A8F000CD6A3821DD96187EF15992D4A9B4D6A6CDC848CF8F8C9A2573DADC8E
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402797277507 (0x17a424e2ec9143)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:14 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Augsburg, O = Universitaet Augsburg, OU = Rechenzentrum, CN = UAUX-CA, emailAddress = ca-admin@rz.uni-augsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                25:DE:28:05:49:28:84:7F:23:21:CF:1D:20:DA:BE:2E:B7:BE:6B:E6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-admin@rz.uni-augsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EB0DEBFA11BBEA0B7DB860F8837F4EC34FE2818960033CC77D2660A56E21EF17
    SPKI SHA256: F7A8F000CD6A3821DD96187EF15992D4A9B4D6A6CDC848CF8F8C9A2573DADC8E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UAUX-CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Augsburg, organizationName=Universitaet Augsburg, organizationalUnitName=Rechenzentrum, commonName=UAUX-CA, emailAddress=ca-admin@rz.uni-augsburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C3014CE
- SHA-256: 0FDA877459ECD119747B13721CBE56E7B48E8CD063AA8FE975FFA902896409F8
- SPKI SHA-256: F7A8F000CD6A3821DD96187EF15992D4A9B4D6A6CDC848CF8F8C9A2573DADC8E
- Validity: 2008-04-24 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 204477646 (0xc3014ce)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 24 14:20:46 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Augsburg, O = Universitaet Augsburg, OU = Rechenzentrum, CN = UAUX-CA, emailAddress = ca-admin@rz.uni-augsburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                25:DE:28:05:49:28:84:7F:23:21:CF:1D:20:DA:BE:2E:B7:BE:6B:E6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-admin@rz.uni-augsburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0FDA877459ECD119747B13721CBE56E7B48E8CD063AA8FE975FFA902896409F8
    SPKI SHA256: F7A8F000CD6A3821DD96187EF15992D4A9B4D6A6CDC848CF8F8C9A2573DADC8E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UdK Berlin CA

- Subject: countryName=DE, organizationName=Universitaet der Kuenste Berlin, commonName=UdK Berlin CA, emailAddress=pki@udk-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ACEB1E4
- SHA-256: BCD6BEB83396EE3A152D74EBBD2010F94210C204353FB3C19A6E5D4E5E98E596
- SPKI SHA-256: 37923FDBD6B6D5F1A7EA17C12FEEAB0F7A2270CBF084F50683E7C99A6FF51890
- Validity: 2007-07-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 181318116 (0xaceb1e4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 31 13:08:37 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet der Kuenste Berlin, CN = UdK Berlin CA, emailAddress = pki@udk-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:17:16:B5:31:D3:BF:EB:DB:C2:B7:99:0F:65:B9:85:EC:A6:D8:B0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@udk-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BCD6BEB83396EE3A152D74EBBD2010F94210C204353FB3C19A6E5D4E5E98E596
    SPKI SHA256: 37923FDBD6B6D5F1A7EA17C12FEEAB0F7A2270CBF084F50683E7C99A6FF51890
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UdK Berlin CA

- Subject: countryName=DE, organizationName=Universitaet der Kuenste Berlin, commonName=UdK Berlin CA, emailAddress=pki@udk-berlin.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248BCEF0A2
- SHA-256: F6733AD00837F7893AF5A6AA732AC0D4D406DC99147A2D4938702417398E11C4
- SPKI SHA-256: 37923FDBD6B6D5F1A7EA17C12FEEAB0F7A2270CBF084F50683E7C99A6FF51890
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401335718050 (0x17a4248bcef0a2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:47 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet der Kuenste Berlin, CN = UdK Berlin CA, emailAddress = pki@udk-berlin.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:17:16:B5:31:D3:BF:EB:DB:C2:B7:99:0F:65:B9:85:EC:A6:D8:B0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@udk-berlin.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6733AD00837F7893AF5A6AA732AC0D4D406DC99147A2D4938702417398E11C4
    SPKI SHA256: 37923FDBD6B6D5F1A7EA17C12FEEAB0F7A2270CBF084F50683E7C99A6FF51890
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UHH CA - G02

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Universitaet Hamburg, organizationalUnitName=Regionales Rechenzentrum, commonName=UHH CA - G02, emailAddress=uhh-ca@uni-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248C72DE30
- SHA-256: 31BA22F2EECB60E055F8B8A63592CACEBCD141F462208EDC7538D9E2D4B1A612
- SPKI SHA-256: 67BB20DD2B69FBBCEC76654A81D0603AFC1FDE29F5BE28571B6C512E5C0F2E87
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401346461232 (0x17a4248c72de30)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Universitaet Hamburg, OU = Regionales Rechenzentrum, CN = UHH CA - G02, emailAddress = uhh-ca@uni-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                26:A0:6A:01:A8:FF:FC:12:EB:F7:14:89:E3:C5:30:36:D1:2E:39:B2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:uhh-ca@uni-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 31BA22F2EECB60E055F8B8A63592CACEBCD141F462208EDC7538D9E2D4B1A612
    SPKI SHA256: 67BB20DD2B69FBBCEC76654A81D0603AFC1FDE29F5BE28571B6C512E5C0F2E87
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UHH CA - G02

- Subject: countryName=DE, stateOrProvinceName=Hamburg, localityName=Hamburg, organizationName=Universitaet Hamburg, organizationalUnitName=Regionales Rechenzentrum, commonName=UHH CA - G02, emailAddress=uhh-ca@uni-hamburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AE13221
- SHA-256: F459CB04DE71E617BDD7B12A573556C2380450DD43FF33363A2E4C2337022B17
- SPKI SHA-256: 67BB20DD2B69FBBCEC76654A81D0603AFC1FDE29F5BE28571B6C512E5C0F2E87
- Validity: 2007-08-14 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 182530593 (0xae13221)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 14 13:56:35 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hamburg, L = Hamburg, O = Universitaet Hamburg, OU = Regionales Rechenzentrum, CN = UHH CA - G02, emailAddress = uhh-ca@uni-hamburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                26:A0:6A:01:A8:FF:FC:12:EB:F7:14:89:E3:C5:30:36:D1:2E:39:B2
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:uhh-ca@uni-hamburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F459CB04DE71E617BDD7B12A573556C2380450DD43FF33363A2E4C2337022B17
    SPKI SHA256: 67BB20DD2B69FBBCEC76654A81D0603AFC1FDE29F5BE28571B6C512E5C0F2E87
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UKGM CA - G01

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Giessen, organizationName=Universitaetsklinikum Giessen und Marburg GmbH, organizationalUnitName=Standort Marburg, organizationalUnitName=Zentrale Informationsverarbeitung (ZIV), commonName=UKGM CA - G01, emailAddress=ca@uniklinikum-marburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1848D95DF099C8
- SHA-256: AEBAEA391F7FE1585DEB471C19C84D03A04586677DB74BA7C59500902A210E65
- SPKI SHA-256: 179B06AF1315E5A48DD332CAEF67C7A6209CF3435DB43F9644DA5DAAE82302B0
- Validity: 2014-09-29 to 2019-07-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6835497862207944 (0x1848d95df099c8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 29 13:17:02 2014 GMT
            Not After : Jul  8 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Giessen, O = Universitaetsklinikum Giessen und Marburg GmbH, OU = Standort Marburg, OU = Zentrale Informationsverarbeitung (ZIV), CN = UKGM CA - G01, emailAddress = ca@uniklinikum-marburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                F7:A2:E9:4E:AF:14:D6:F4:72:7A:53:6B:A5:0E:F4:97:4E:90:3B:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uniklinikum-marburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AEBAEA391F7FE1585DEB471C19C84D03A04586677DB74BA7C59500902A210E65
    SPKI SHA256: 179B06AF1315E5A48DD332CAEF67C7A6209CF3435DB43F9644DA5DAAE82302B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Umweltbundesamt CA - G01

- Subject: countryName=DE, organizationName=Umweltbundesamt, commonName=Umweltbundesamt CA - G01
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 186EDBBEF983C6
- SHA-256: 6B6EA864EA1751E04F319DCAC20F8D9EF6EF6C8F18DCB115FB4F2836E3F89246
- SPKI SHA-256: F265F8C99563A97B9BAC4E3A0F47FE5CA8DA2203EA23748FA0E0F337BA8A0017
- Validity: 2014-10-28 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6877289521972166 (0x186edbbef983c6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 28 09:13:18 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Umweltbundesamt, CN = Umweltbundesamt CA - G01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                C7:CA:00:83:35:7A:F0:55:E8:F3:4B:68:B3:B7:A7:7B:9D:23:4D:27
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6B6EA864EA1751E04F319DCAC20F8D9EF6EF6C8F18DCB115FB4F2836E3F89246
    SPKI SHA256: F265F8C99563A97B9BAC4E3A0F47FE5CA8DA2203EA23748FA0E0F337BA8A0017
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Bamberg CA - G02

- Subject: countryName=DE, organizationName=Otto-Friedrich-Universitaet Bamberg, organizationalUnitName=Rechenzentrum, commonName=Uni Bamberg CA - G02, emailAddress=pki@urz.uni-bamberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610303C574
- SHA-256: 6BE0F7F29C328187A0C94CE993D3496642C093EAF258375F4156BE2757081F13
- SPKI SHA-256: 85840E9D74A07889EBA193AF10D58D628F2C47967F0BCBBE1A230EAD9B6B6D4A
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670801151348 (0x1790610303c574)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:27 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Otto-Friedrich-Universitaet Bamberg, OU = Rechenzentrum, CN = Uni Bamberg CA - G02, emailAddress = pki@urz.uni-bamberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2D:CC:98:1E:49:5B:1E:D7:6E:61:07:26:AD:53:65:67:98:43:AE:E5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@urz.uni-bamberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6BE0F7F29C328187A0C94CE993D3496642C093EAF258375F4156BE2757081F13
    SPKI SHA256: 85840E9D74A07889EBA193AF10D58D628F2C47967F0BCBBE1A230EAD9B6B6D4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Bamberg CA - G02

- Subject: countryName=DE, organizationName=Otto-Friedrich-Universitaet Bamberg, organizationalUnitName=Rechenzentrum, commonName=Uni Bamberg CA - G02, emailAddress=pki@urz.uni-bamberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A285C36
- SHA-256: 20EAA58DEDC49CC3D88A156C3CD63A36DDA3E2D2FD29537E4A9117EA8D907907
- SPKI SHA-256: 85840E9D74A07889EBA193AF10D58D628F2C47967F0BCBBE1A230EAD9B6B6D4A
- Validity: 2007-03-27 to 2019-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 170417206 (0xa285c36)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 27 09:06:48 2007 GMT
            Not After : Mar 26 00:00:00 2019 GMT
        Subject: C = DE, O = Otto-Friedrich-Universitaet Bamberg, OU = Rechenzentrum, CN = Uni Bamberg CA - G02, emailAddress = pki@urz.uni-bamberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2D:CC:98:1E:49:5B:1E:D7:6E:61:07:26:AD:53:65:67:98:43:AE:E5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@urz.uni-bamberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 20EAA58DEDC49CC3D88A156C3CD63A36DDA3E2D2FD29537E4A9117EA8D907907
    SPKI SHA256: 85840E9D74A07889EBA193AF10D58D628F2C47967F0BCBBE1A230EAD9B6B6D4A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Dortmund CA - G01

- Subject: countryName=DE, organizationName=Universitaet Dortmund, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Dortmund CA - G01, emailAddress=ca@pki.uni-dortmund.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DE9958
- SHA-256: C796A70F09E66B2B47EDEFCC1EB0AF567445FBCF13E9B07F95FDA85501D46FE2
- SPKI SHA-256: A9C068F7166B87544023B981E32165FC204F05BC87EEC5521353AD4EC44F37A0
- Validity: 2007-01-30 to 2019-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165583192 (0x9de9958)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 30 10:19:54 2007 GMT
            Not After : Jan 29 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Dortmund, OU = Hochschulrechenzentrum, CN = Uni Dortmund CA - G01, emailAddress = ca@pki.uni-dortmund.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B6:C5:4C:1E:86:86:9C:1A:88:51:35:EE:14:66:99:C1:33:EB:C3:3C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@pki.uni-dortmund.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C796A70F09E66B2B47EDEFCC1EB0AF567445FBCF13E9B07F95FDA85501D46FE2
    SPKI SHA256: A9C068F7166B87544023B981E32165FC204F05BC87EEC5521353AD4EC44F37A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Duesseldorf CA-G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Duesseldorf, organizationName=Heinrich-Heine-Universitaet Duesseldorf, commonName=Uni Duesseldorf CA-G01, emailAddress=ca@uni-duesseldorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E5AEA25
- SHA-256: 41F43B665AC8D6DB38604BF4938422BFBEC70F8FC55D83CAE49EC6C88108C351
- SPKI SHA-256: CDC58A0CCBCC94A1630FF567A363733F03D164AC014C9AE87A973C00B7DD27FF
- Validity: 2009-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 240839205 (0xe5aea25)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 10:46:46 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Duesseldorf, O = Heinrich-Heine-Universitaet Duesseldorf, CN = Uni Duesseldorf CA-G01, emailAddress = ca@uni-duesseldorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:24:31:84:A2:AF:87:30:02:7E:CD:8F:71:5B:F6:84:B5:4A:EC:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-duesseldorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 41F43B665AC8D6DB38604BF4938422BFBEC70F8FC55D83CAE49EC6C88108C351
    SPKI SHA256: CDC58A0CCBCC94A1630FF567A363733F03D164AC014C9AE87A973C00B7DD27FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Duesseldorf CA-G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Duesseldorf, organizationName=Heinrich-Heine-Universitaet Duesseldorf, commonName=Uni Duesseldorf CA-G01, emailAddress=ca@uni-duesseldorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B5CB45BD
- SHA-256: CA9D80FDB975EC10EA3BCA2C7A3D93C7549A6E906E77196CF84CFCF78B02EABA
- SPKI SHA-256: CDC58A0CCBCC94A1630FF567A363733F03D164AC014C9AE87A973C00B7DD27FF
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398611158461 (0x17aff6b5cb45bd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:25 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Duesseldorf, O = Heinrich-Heine-Universitaet Duesseldorf, CN = Uni Duesseldorf CA-G01, emailAddress = ca@uni-duesseldorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                62:24:31:84:A2:AF:87:30:02:7E:CD:8F:71:5B:F6:84:B5:4A:EC:36
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-duesseldorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CA9D80FDB975EC10EA3BCA2C7A3D93C7549A6E906E77196CF84CFCF78B02EABA
    SPKI SHA256: CDC58A0CCBCC94A1630FF567A363733F03D164AC014C9AE87A973C00B7DD27FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Flensburg CA

- Subject: countryName=DE, organizationName=Universitaet Flensburg, organizationalUnitName=ZIMT, commonName=Uni Flensburg CA, emailAddress=ca@uni-flensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CA699E7
- SHA-256: 5118FBF0F77CC0569DA08B5009626D4E99148956205CF8FCA44FD114AF19D04E
- SPKI SHA-256: CB17D38FE33C667A66FDCDAC615ECCD937DD5EBC01125BACA417BB0E372C0D63
- Validity: 2008-07-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 212244967 (0xca699e7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 23 11:56:08 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Flensburg, OU = ZIMT, CN = Uni Flensburg CA, emailAddress = ca@uni-flensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C5:14:E7:52:AC:E1:28:B6:E4:D6:A6:3A:03:70:F0:08:29:E5:09:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-flensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5118FBF0F77CC0569DA08B5009626D4E99148956205CF8FCA44FD114AF19D04E
    SPKI SHA256: CB17D38FE33C667A66FDCDAC615ECCD937DD5EBC01125BACA417BB0E372C0D63
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Flensburg CA

- Subject: countryName=DE, organizationName=Universitaet Flensburg, organizationalUnitName=ZIMT, commonName=Uni Flensburg CA, emailAddress=ca@uni-flensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424C14A7C6F
- SHA-256: 914B03B17B3A26360FCC522F0DBF2F79F64C77E39F3171F4B620F00ED838FDB8
- SPKI SHA-256: CB17D38FE33C667A66FDCDAC615ECCD937DD5EBC01125BACA417BB0E372C0D63
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402233007215 (0x17a424c14a7c6f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:41 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Flensburg, OU = ZIMT, CN = Uni Flensburg CA, emailAddress = ca@uni-flensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C5:14:E7:52:AC:E1:28:B6:E4:D6:A6:3A:03:70:F0:08:29:E5:09:06
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-flensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 914B03B17B3A26360FCC522F0DBF2F79F64C77E39F3171F4B620F00ED838FDB8
    SPKI SHA256: CB17D38FE33C667A66FDCDAC615ECCD937DD5EBC01125BACA417BB0E372C0D63
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Halle Chipcard CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle (Saale), organizationName=Martin-Luther-Universitaet Halle-Wittenberg, commonName=Uni Halle Chipcard CA, emailAddress=pki@uni-halle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F4712AE
- SHA-256: 53A84FF59643E44758E7BB1333FCD5E822B694E4DEA00CEFC049EB15D3D6F7E7
- SPKI SHA-256: B48489198776BDBE86D08D0E7E0BAADA6E8DB92BE31E987AA6B14742E5E00D14
- Validity: 2009-12-15 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 256316078 (0xf4712ae)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 15 13:54:38 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Halle (Saale), O = Martin-Luther-Universitaet Halle-Wittenberg, CN = Uni Halle Chipcard CA, emailAddress = pki@uni-halle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1D:C6:D8:53:A1:9A:EE:E5:EA:BD:46:B3:4C:05:FD:82:9E:A7:3C:C6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-halle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 53A84FF59643E44758E7BB1333FCD5E822B694E4DEA00CEFC049EB15D3D6F7E7
    SPKI SHA256: B48489198776BDBE86D08D0E7E0BAADA6E8DB92BE31E987AA6B14742E5E00D14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Halle Chipcard CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle (Saale), organizationName=Martin-Luther-Universitaet Halle-Wittenberg, commonName=Uni Halle Chipcard CA, emailAddress=pki@uni-halle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C68CAD69
- SHA-256: 4ECEBF3F6E893AC3B49106D291C35D194712FC12B70F5D30D6C6982D289068B7
- SPKI SHA-256: B48489198776BDBE86D08D0E7E0BAADA6E8DB92BE31E987AA6B14742E5E00D14
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398892268905 (0x17aff6c68cad69)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:42 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Halle (Saale), O = Martin-Luther-Universitaet Halle-Wittenberg, CN = Uni Halle Chipcard CA, emailAddress = pki@uni-halle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1D:C6:D8:53:A1:9A:EE:E5:EA:BD:46:B3:4C:05:FD:82:9E:A7:3C:C6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-halle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4ECEBF3F6E893AC3B49106D291C35D194712FC12B70F5D30D6C6982D289068B7
    SPKI SHA256: B48489198776BDBE86D08D0E7E0BAADA6E8DB92BE31E987AA6B14742E5E00D14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Hildesheim CA

- Subject: countryName=DE, organizationName=Universitaet Hildesheim, organizationalUnitName=Rechenzentrum, commonName=Uni Hildesheim CA, emailAddress=unihica@uni-hildesheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0BA6E4A6
- SHA-256: 61C53FC40082A038CC7632D4FA96B7B90C4952FD97E37D907DF78D27A133FC45
- SPKI SHA-256: 3F47AFDB216A7D78D3CA83E1F7084354DAC3D4D49686CA8FB9297243654FCF07
- Validity: 2008-01-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 195486886 (0xba6e4a6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 11 12:54:47 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Hildesheim, OU = Rechenzentrum, CN = Uni Hildesheim CA, emailAddress = unihica@uni-hildesheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9E:05:84:7C:14:A1:BC:3B:D0:4A:EF:F7:4B:0F:81:23:13:47:32:5F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unihica@uni-hildesheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 61C53FC40082A038CC7632D4FA96B7B90C4952FD97E37D907DF78D27A133FC45
    SPKI SHA256: 3F47AFDB216A7D78D3CA83E1F7084354DAC3D4D49686CA8FB9297243654FCF07
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Hildesheim CA

- Subject: countryName=DE, organizationName=Universitaet Hildesheim, organizationalUnitName=Rechenzentrum, commonName=Uni Hildesheim CA, emailAddress=unihica@uni-hildesheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A4D1EDA6
- SHA-256: 9698E4E3D3355BDD3E1290799C296B34A49DB3CCEB43393025FE41EE1C489A8B
- SPKI SHA-256: 3F47AFDB216A7D78D3CA83E1F7084354DAC3D4D49686CA8FB9297243654FCF07
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401755344294 (0x17a424a4d1eda6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:12 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Hildesheim, OU = Rechenzentrum, CN = Uni Hildesheim CA, emailAddress = unihica@uni-hildesheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9E:05:84:7C:14:A1:BC:3B:D0:4A:EF:F7:4B:0F:81:23:13:47:32:5F
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unihica@uni-hildesheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9698E4E3D3355BDD3E1290799C296B34A49DB3CCEB43393025FE41EE1C489A8B
    SPKI SHA256: 3F47AFDB216A7D78D3CA83E1F7084354DAC3D4D49686CA8FB9297243654FCF07
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Kassel Certification Authority (UniKassel-CA) - G02

- Subject: countryName=DE, organizationName=Universitaet Kassel, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress=ca@uni-kassel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93DB3
- SHA-256: D7238B080A116FBB76AB709AEF6878F04A061E950852C5F9EE41A3E5D71E8792
- SPKI SHA-256: 209F84B9F703A75279BD14E77726444D8A143B2CCC7ABFCEFEC76F1E5D48DC55
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329203 (0x9f93db3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:20:04 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Kassel, OU = Hochschulrechenzentrum, CN = Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress = ca@uni-kassel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                17:3D:F2:AE:83:DC:61:80:A4:E8:90:CC:80:97:79:35:0D:7D:02:4C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-kassel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D7238B080A116FBB76AB709AEF6878F04A061E950852C5F9EE41A3E5D71E8792
    SPKI SHA256: 209F84B9F703A75279BD14E77726444D8A143B2CCC7ABFCEFEC76F1E5D48DC55
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Kassel Certification Authority (UniKassel-CA) - G02

- Subject: countryName=DE, organizationName=Universitaet Kassel, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress=ca@uni-kassel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E495B2A5
- SHA-256: 8F4D25D64584EAEAE3675FBD77DE5CBCD53AA9FDCC29E2F2BCAB0007C9DA79A5
- SPKI SHA-256: 209F84B9F703A75279BD14E77726444D8A143B2CCC7ABFCEFEC76F1E5D48DC55
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670290621093 (0x179060e495b2a5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:56 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Kassel, OU = Hochschulrechenzentrum, CN = Uni Kassel Certification Authority (UniKassel-CA) - G02, emailAddress = ca@uni-kassel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                17:3D:F2:AE:83:DC:61:80:A4:E8:90:CC:80:97:79:35:0D:7D:02:4C
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-kassel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F4D25D64584EAEAE3675FBD77DE5CBCD53AA9FDCC29E2F2BCAB0007C9DA79A5
    SPKI SHA256: 209F84B9F703A75279BD14E77726444D8A143B2CCC7ABFCEFEC76F1E5D48DC55
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Kiel CA - G02

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Kiel, organizationName=Universitaet Kiel, organizationalUnitName=Rechenzentrum, commonName=Uni Kiel CA - G02, emailAddress=pki@uni-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610E0D7FB9
- SHA-256: 5F16BFBB1C5F6A520D0D393434D4391F18E9024EE3C6FA7F41325D1E9C948BD3
- SPKI SHA-256: 155D5F7E5000B7E6DC0B71B77CEFBAB36078F8C3E76CE21FBDB19ADC2AEAA0AE
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670986338233 (0x1790610e0d7fb9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Kiel, O = Universitaet Kiel, OU = Rechenzentrum, CN = Uni Kiel CA - G02, emailAddress = pki@uni-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                79:87:42:9A:DD:0F:8D:AE:9F:35:90:A4:15:CB:E3:04:F2:B7:B1:51
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F16BFBB1C5F6A520D0D393434D4391F18E9024EE3C6FA7F41325D1E9C948BD3
    SPKI SHA256: 155D5F7E5000B7E6DC0B71B77CEFBAB36078F8C3E76CE21FBDB19ADC2AEAA0AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Kiel CA - G02

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, localityName=Kiel, organizationName=Universitaet Kiel, organizationalUnitName=Rechenzentrum, commonName=Uni Kiel CA - G02, emailAddress=pki@uni-kiel.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC82
- SHA-256: 26E22B77AAE4BF799D46E7C07A980087558C58CBF08E262E925C3564942154CF
- SPKI SHA-256: 155D5F7E5000B7E6DC0B71B77CEFBAB36078F8C3E76CE21FBDB19ADC2AEAA0AE
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027586 (0xa31ac82)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:47 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, L = Kiel, O = Universitaet Kiel, OU = Rechenzentrum, CN = Uni Kiel CA - G02, emailAddress = pki@uni-kiel.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                79:87:42:9A:DD:0F:8D:AE:9F:35:90:A4:15:CB:E3:04:F2:B7:B1:51
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-kiel.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 26E22B77AAE4BF799D46E7C07A980087558C58CBF08E262E925C3564942154CF
    SPKI SHA256: 155D5F7E5000B7E6DC0B71B77CEFBAB36078F8C3E76CE21FBDB19ADC2AEAA0AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Magdeburg CA

- Subject: countryName=DE, organizationName=Otto-von-Guericke-Universitaet Magdeburg, commonName=Uni Magdeburg CA, emailAddress=ca@uni-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D5D94352
- SHA-256: D7462AF0647EE4A8F8D5B4ABE486636253A704AC7A99022C371261037E7EB9F8
- SPKI SHA-256: 1D779A327A91F68AB146E6BC86A5EE791E5AE884AA67B33560EC61E3578674E1
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670043390802 (0x179060d5d94352)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:41 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Otto-von-Guericke-Universitaet Magdeburg, CN = Uni Magdeburg CA, emailAddress = ca@uni-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                08:6B:40:DA:AB:2A:42:F2:2E:95:33:38:63:45:DF:C9:23:3F:26:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7462AF0647EE4A8F8D5B4ABE486636253A704AC7A99022C371261037E7EB9F8
    SPKI SHA256: 1D779A327A91F68AB146E6BC86A5EE791E5AE884AA67B33560EC61E3578674E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Magdeburg CA

- Subject: countryName=DE, organizationName=Otto-von-Guericke-Universitaet Magdeburg, commonName=Uni Magdeburg CA, emailAddress=ca@uni-magdeburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E154F7
- SHA-256: 6C03A6B5B01DF504E5AF7886E6BCEB77E14D09F07F42E397952783B9CEA38C6A
- SPKI SHA-256: 1D779A327A91F68AB146E6BC86A5EE791E5AE884AA67B33560EC61E3578674E1
- Validity: 2007-02-01 to 2019-01-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165762295 (0x9e154f7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  1 12:04:57 2007 GMT
            Not After : Jan 31 00:00:00 2019 GMT
        Subject: C = DE, O = Otto-von-Guericke-Universitaet Magdeburg, CN = Uni Magdeburg CA, emailAddress = ca@uni-magdeburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                08:6B:40:DA:AB:2A:42:F2:2E:95:33:38:63:45:DF:C9:23:3F:26:84
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-magdeburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6C03A6B5B01DF504E5AF7886E6BCEB77E14D09F07F42E397952783B9CEA38C6A
    SPKI SHA256: 1D779A327A91F68AB146E6BC86A5EE791E5AE884AA67B33560EC61E3578674E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Marburg CA - G02

- Subject: countryName=DE, organizationName=Universitaet Marburg, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Marburg CA - G02, emailAddress=pki@uni-marburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D9AFCD84
- SHA-256: BC32C8286F8CC7FF3D6E7E7FA814F0BD578FE590F48A53936227568DE4F4574F
- SPKI SHA-256: A00309D116E9DBD0F85DDB49242885DB714BEE0E8E4B8D8863EAC9DD1532A133
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670107782532 (0x179060d9afcd84)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Marburg, OU = Hochschulrechenzentrum, CN = Uni Marburg CA - G02, emailAddress = pki@uni-marburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:7A:5F:B0:AE:34:2D:7F:8C:13:9F:D7:2F:02:21:98:09:8F:2A:F3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-marburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC32C8286F8CC7FF3D6E7E7FA814F0BD578FE590F48A53936227568DE4F4574F
    SPKI SHA256: A00309D116E9DBD0F85DDB49242885DB714BEE0E8E4B8D8863EAC9DD1532A133
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Marburg CA - G02

- Subject: countryName=DE, organizationName=Universitaet Marburg, organizationalUnitName=Hochschulrechenzentrum, commonName=Uni Marburg CA - G02, emailAddress=pki@uni-marburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6A02C
- SHA-256: 37BAB9C4A96F09009C61686EC93DB7EFEA076A301C155AD80267FD6FF86F8ECB
- SPKI SHA-256: A00309D116E9DBD0F85DDB49242885DB714BEE0E8E4B8D8863EAC9DD1532A133
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166109228 (0x9e6a02c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 12:27:09 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Marburg, OU = Hochschulrechenzentrum, CN = Uni Marburg CA - G02, emailAddress = pki@uni-marburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F1:7A:5F:B0:AE:34:2D:7F:8C:13:9F:D7:2F:02:21:98:09:8F:2A:F3
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-marburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 37BAB9C4A96F09009C61686EC93DB7EFEA076A301C155AD80267FD6FF86F8ECB
    SPKI SHA256: A00309D116E9DBD0F85DDB49242885DB714BEE0E8E4B8D8863EAC9DD1532A133
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Regensburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Regensburg, organizationName=Universitaet Regensburg, commonName=Uni Regensburg CA - G01, emailAddress=pki@uni-regensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424BA4422E5
- SHA-256: E7CEF2EFB3B491EBAF70014F6FC9C5095A8C986B5358B37A7F5597E6B3FE3A5A
- SPKI SHA-256: 48ED81909FD91BDD23A0E74D3B8AE02083E02BA2E402D7B41F4C9DB5C9D03255
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402115150565 (0x17a424ba4422e5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Regensburg, O = Universitaet Regensburg, CN = Uni Regensburg CA - G01, emailAddress = pki@uni-regensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                07:D7:DD:79:88:5F:41:71:CC:16:E1:D4:C7:F3:9D:B2:78:B1:DD:48
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-regensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E7CEF2EFB3B491EBAF70014F6FC9C5095A8C986B5358B37A7F5597E6B3FE3A5A
    SPKI SHA256: 48ED81909FD91BDD23A0E74D3B8AE02083E02BA2E402D7B41F4C9DB5C9D03255
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Regensburg CA - G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Regensburg, organizationName=Universitaet Regensburg, commonName=Uni Regensburg CA - G01, emailAddress=pki@uni-regensburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C2C0608
- SHA-256: 4C99347F658F6A85522D1D214D7E1C6188F136A7B5396E24DC370B8848BEE158
- SPKI SHA-256: 48ED81909FD91BDD23A0E74D3B8AE02083E02BA2E402D7B41F4C9DB5C9D03255
- Validity: 2008-04-21 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 204211720 (0xc2c0608)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 21 12:28:41 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Regensburg, O = Universitaet Regensburg, CN = Uni Regensburg CA - G01, emailAddress = pki@uni-regensburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                07:D7:DD:79:88:5F:41:71:CC:16:E1:D4:C7:F3:9D:B2:78:B1:DD:48
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-regensburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4C99347F658F6A85522D1D214D7E1C6188F136A7B5396E24DC370B8848BEE158
    SPKI SHA256: 48ED81909FD91BDD23A0E74D3B8AE02083E02BA2E402D7B41F4C9DB5C9D03255
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Rostock CA - G02

- Subject: countryName=DE, organizationName=Universitaet Rostock, organizationalUnitName=Rechenzentrum, commonName=Uni Rostock CA - G02, emailAddress=ca@uni-rostock.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC69
- SHA-256: 2E0076F8864D961C8EAE21D7E2CBC8681EC80FC88CFCF4940C9F373FDE6BEECB
- SPKI SHA-256: C6409AE74DC8F121DE7562BD160125E9F7327DAA8304F582E2254C62BAA91F1A
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027561 (0xa31ac69)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:22 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Rostock, OU = Rechenzentrum, CN = Uni Rostock CA - G02, emailAddress = ca@uni-rostock.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B3:15:F5:A2:57:8F:83:7B:D4:10:D3:5C:F2:8E:3E:53:F7:6F:43:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-rostock.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2E0076F8864D961C8EAE21D7E2CBC8681EC80FC88CFCF4940C9F373FDE6BEECB
    SPKI SHA256: C6409AE74DC8F121DE7562BD160125E9F7327DAA8304F582E2254C62BAA91F1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni Rostock CA - G02

- Subject: countryName=DE, organizationName=Universitaet Rostock, organizationalUnitName=Rechenzentrum, commonName=Uni Rostock CA - G02, emailAddress=ca@uni-rostock.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610B4B7EEC
- SHA-256: BC89DC6F776348E9541B5184247DA80163E9D005D6D2834F5027B54C7A231902
- SPKI SHA-256: C6409AE74DC8F121DE7562BD160125E9F7327DAA8304F582E2254C62BAA91F1A
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670940069612 (0x1790610b4b7eec)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:35 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Rostock, OU = Rechenzentrum, CN = Uni Rostock CA - G02, emailAddress = ca@uni-rostock.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B3:15:F5:A2:57:8F:83:7B:D4:10:D3:5C:F2:8E:3E:53:F7:6F:43:37
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-rostock.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC89DC6F776348E9541B5184247DA80163E9D005D6D2834F5027B54C7A231902
    SPKI SHA256: C6409AE74DC8F121DE7562BD160125E9F7327DAA8304F582E2254C62BAA91F1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Witten/Herdecke CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Witten, organizationName=Private Universitaet Witten/Herdecke gGmbH, organizationalUnitName=BIT, commonName=Uni Witten/Herdecke CA - G01, emailAddress=ca@uni-wh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF706CF2EF5
- SHA-256: DB541B936F5EBA17004B33C3DE124204DC76553B84ED11203668B5EED1A5E204
- SPKI SHA-256: E893E2984745B1E822A4DFA61A1994D952EB91E5C1ED1DB5493EE631DA3D839D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399970369269 (0x17aff706cf2ef5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:46 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Witten, O = Private Universitaet Witten/Herdecke gGmbH, OU = BIT, CN = Uni Witten/Herdecke CA - G01, emailAddress = ca@uni-wh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:8C:CC:36:64:6B:75:C5:8A:A5:0F:19:F8:BC:C8:3E:69:F8:F8:F6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-wh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DB541B936F5EBA17004B33C3DE124204DC76553B84ED11203668B5EED1A5E204
    SPKI SHA256: E893E2984745B1E822A4DFA61A1994D952EB91E5C1ED1DB5493EE631DA3D839D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni Witten/Herdecke CA - G01

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Witten, organizationName=Private Universitaet Witten/Herdecke gGmbH, organizationalUnitName=BIT, commonName=Uni Witten/Herdecke CA - G01, emailAddress=ca@uni-wh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 13E547450D927C
- SHA-256: 5E9437D78A991F1C7EB6D9980C269E71D3D531C2BD01CE42B7E9EA4F9AA9CA69
- SPKI SHA-256: E893E2984745B1E822A4DFA61A1994D952EB91E5C1ED1DB5493EE631DA3D839D
- Validity: 2012-05-30 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5600118821458556 (0x13e547450d927c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 30 07:18:14 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Witten, O = Private Universitaet Witten/Herdecke gGmbH, OU = BIT, CN = Uni Witten/Herdecke CA - G01, emailAddress = ca@uni-wh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E8:8C:CC:36:64:6B:75:C5:8A:A5:0F:19:F8:BC:C8:3E:69:F8:F8:F6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-wh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5E9437D78A991F1C7EB6D9980C269E71D3D531C2BD01CE42B7E9EA4F9AA9CA69
    SPKI SHA256: E893E2984745B1E822A4DFA61A1994D952EB91E5C1ED1DB5493EE631DA3D839D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UNI-FFM CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt am Main, organizationName=Johann Wolfgang Goethe-Universitaet, commonName=UNI-FFM CA, emailAddress=ca@uni-frankfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0E30DB95
- SHA-256: AC5954B25B9EB2C58CECEE1D75AA8F94A86253B44F70BFD888239C2565F30646
- SPKI SHA-256: 271F0505051CB95B67F1DB67DA7B5B8BB4307F78CCB716C321B4C8BAB3971DFF
- Validity: 2009-05-18 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 238082965 (0xe30db95)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 18 13:09:25 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Frankfurt am Main, O = Johann Wolfgang Goethe-Universitaet, CN = UNI-FFM CA, emailAddress = ca@uni-frankfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                63:59:77:B1:46:6F:E1:E6:AB:AF:C2:C7:93:FF:5F:71:0D:4F:E0:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-frankfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AC5954B25B9EB2C58CECEE1D75AA8F94A86253B44F70BFD888239C2565F30646
    SPKI SHA256: 271F0505051CB95B67F1DB67DA7B5B8BB4307F78CCB716C321B4C8BAB3971DFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UNI-FFM CA

- Subject: countryName=DE, stateOrProvinceName=Hessen, localityName=Frankfurt am Main, organizationName=Johann Wolfgang Goethe-Universitaet, commonName=UNI-FFM CA, emailAddress=ca@uni-frankfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6B1398F20
- SHA-256: 9AD43B8B316A803E937134B4CABD07901BE616A61D870A6A387907A5778964A9
- SPKI SHA-256: 271F0505051CB95B67F1DB67DA7B5B8BB4307F78CCB716C321B4C8BAB3971DFF
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398534500128 (0x17aff6b1398f20)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:21 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Hessen, L = Frankfurt am Main, O = Johann Wolfgang Goethe-Universitaet, CN = UNI-FFM CA, emailAddress = ca@uni-frankfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                63:59:77:B1:46:6F:E1:E6:AB:AF:C2:C7:93:FF:5F:71:0D:4F:E0:FF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-frankfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9AD43B8B316A803E937134B4CABD07901BE616A61D870A6A387907A5778964A9
    SPKI SHA256: 271F0505051CB95B67F1DB67DA7B5B8BB4307F78CCB716C321B4C8BAB3971DFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-FR CA - G02

- Subject: countryName=DE, organizationName=Universitaet Freiburg, organizationalUnitName=Rechenzentrum, commonName=Uni-FR CA - G02, emailAddress=pki@rz.uni-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0CB183
- SHA-256: 9AA0A5246FF3B3D9492DF954AA5B0419C78F465B151990AA8ED8A5BBD47EAD63
- SPKI SHA-256: B8FEC5AC04DCAF79169972AE359D44C4E4F9E99700E8C89F7F044C277831E427
- Validity: 2007-03-06 to 2019-03-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168604035 (0xa0cb183)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  6 09:27:17 2007 GMT
            Not After : Mar  5 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Freiburg, OU = Rechenzentrum, CN = Uni-FR CA - G02, emailAddress = pki@rz.uni-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                33:67:A9:D6:F1:93:55:36:AC:A1:32:BD:C1:E4:96:39:FF:4C:70:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rz.uni-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9AA0A5246FF3B3D9492DF954AA5B0419C78F465B151990AA8ED8A5BBD47EAD63
    SPKI SHA256: B8FEC5AC04DCAF79169972AE359D44C4E4F9E99700E8C89F7F044C277831E427
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-FR CA - G02

- Subject: countryName=DE, organizationName=Universitaet Freiburg, organizationalUnitName=Rechenzentrum, commonName=Uni-FR CA - G02, emailAddress=pki@rz.uni-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060EE9096EF
- SHA-256: 7FDE4E3BB52054093A4A5A7831EE463587C3C16CCE22D1D48D697E40E30DEFFE
- SPKI SHA-256: B8FEC5AC04DCAF79169972AE359D44C4E4F9E99700E8C89F7F044C277831E427
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670458058479 (0x179060ee9096ef)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Freiburg, OU = Rechenzentrum, CN = Uni-FR CA - G02, emailAddress = pki@rz.uni-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:67:A9:D6:F1:93:55:36:AC:A1:32:BD:C1:E4:96:39:FF:4C:70:31
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@rz.uni-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7FDE4E3BB52054093A4A5A7831EE463587C3C16CCE22D1D48D697E40E30DEFFE
    SPKI SHA256: B8FEC5AC04DCAF79169972AE359D44C4E4F9E99700E8C89F7F044C277831E427
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-HD2-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Universitaet Heidelberg, organizationalUnitName=uni, commonName=Uni-HD2-CA, emailAddress=pki@urz.uni-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C5629CB
- SHA-256: F6F8DF870A05FDBFE5B77CA9DA2A468675B685950C4CB3001C12762829C42693
- SPKI SHA-256: DD5E2A3ECCC17DFBBFA9F278EC17B3DE3E55E6F4E7BB63FE31EA2D16C358B1FC
- Validity: 2008-05-23 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 206973387 (0xc5629cb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 23 11:36:27 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Universitaet Heidelberg, OU = uni, CN = Uni-HD2-CA, emailAddress = pki@urz.uni-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BB:A0:3B:AC:F8:F0:60:8C:B4:D0:D5:F9:B8:90:E0:AC:92:15:57:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@urz.uni-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F6F8DF870A05FDBFE5B77CA9DA2A468675B685950C4CB3001C12762829C42693
    SPKI SHA256: DD5E2A3ECCC17DFBBFA9F278EC17B3DE3E55E6F4E7BB63FE31EA2D16C358B1FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-HD2-CA

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Heidelberg, organizationName=Universitaet Heidelberg, organizationalUnitName=uni, commonName=Uni-HD2-CA, emailAddress=pki@urz.uni-heidelberg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424DDE5C8E8
- SHA-256: 51E3AF9E684DA0C2CA86605BD63FB70ABF253E6188E5B05FC54B7DE7F7CA27F7
- SPKI SHA-256: DD5E2A3ECCC17DFBBFA9F278EC17B3DE3E55E6F4E7BB63FE31EA2D16C358B1FC
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402712946920 (0x17a424dde5c8e8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:55:09 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Heidelberg, O = Universitaet Heidelberg, OU = uni, CN = Uni-HD2-CA, emailAddress = pki@urz.uni-heidelberg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BB:A0:3B:AC:F8:F0:60:8C:B4:D0:D5:F9:B8:90:E0:AC:92:15:57:1B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@urz.uni-heidelberg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 51E3AF9E684DA0C2CA86605BD63FB70ABF253E6188E5B05FC54B7DE7F7CA27F7
    SPKI SHA256: DD5E2A3ECCC17DFBBFA9F278EC17B3DE3E55E6F4E7BB63FE31EA2D16C358B1FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-Konstanz CA-S001

- Subject: countryName=DE, organizationName=Uni-Konstanz, commonName=Uni-Konstanz CA-S001, emailAddress=ca@uni-konstanz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F10A70
- SHA-256: 8D00021BB11901D0B988E028E8C5E39F7CABFE51988F2E153FEE5385E7B51D96
- SPKI SHA-256: 97371AE4DCFEF97F88D4318F2C0B2D7C685617875D36B79F06911B87AF49A444
- Validity: 2007-02-13 to 2019-02-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166791792 (0x9f10a70)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 13 10:03:13 2007 GMT
            Not After : Feb 12 00:00:00 2019 GMT
        Subject: C = DE, O = Uni-Konstanz, CN = Uni-Konstanz CA-S001, emailAddress = ca@uni-konstanz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D9:62:74:8A:17:8B:5C:16:22:62:BC:27:0E:E3:EF:1A:9C:9C:B5:43
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-konstanz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8D00021BB11901D0B988E028E8C5E39F7CABFE51988F2E153FEE5385E7B51D96
    SPKI SHA256: 97371AE4DCFEF97F88D4318F2C0B2D7C685617875D36B79F06911B87AF49A444
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-Konstanz CA-S001

- Subject: countryName=DE, organizationName=Uni-Konstanz, commonName=Uni-Konstanz CA-S001, emailAddress=ca@uni-konstanz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E0B33DAA
- SHA-256: ADDC55F3154579C68367A8EA0E286526175200D24AAD9F8A422A2BC8ACED330F
- SPKI SHA-256: 97371AE4DCFEF97F88D4318F2C0B2D7C685617875D36B79F06911B87AF49A444
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670225448362 (0x179060e0b33daa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:52 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Uni-Konstanz, CN = Uni-Konstanz CA-S001, emailAddress = ca@uni-konstanz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D9:62:74:8A:17:8B:5C:16:22:62:BC:27:0E:E3:EF:1A:9C:9C:B5:43
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-konstanz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ADDC55F3154579C68367A8EA0E286526175200D24AAD9F8A422A2BC8ACED330F
    SPKI SHA256: 97371AE4DCFEF97F88D4318F2C0B2D7C685617875D36B79F06911B87AF49A444
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-Osnabrueck RZ-CA G-002

- Subject: countryName=DE, organizationName=Universitaet Osnabrueck, organizationalUnitName=Rechenzentrum, commonName=Uni-Osnabrueck RZ-CA G-002, emailAddress=ca@uni-osnabrueck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A972452
- SHA-256: F16D7AF347AAE0A91FB39AD106A0E67CE8E1BF5EEC8841A9BF593B681C77BEAB
- SPKI SHA-256: C7099DA88F77DB9B6152A29714F31B9B1C75D1D5E48F5FD08A920FF1350B48E7
- Validity: 2007-06-19 to 2019-06-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677394 (0xa972452)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 09:49:55 2007 GMT
            Not After : Jun 18 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Osnabrueck, OU = Rechenzentrum, CN = Uni-Osnabrueck RZ-CA G-002, emailAddress = ca@uni-osnabrueck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AA:1F:D8:77:15:6E:99:E4:5F:90:D6:EC:63:26:4E:19:EA:67:14:50
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-osnabrueck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F16D7AF347AAE0A91FB39AD106A0E67CE8E1BF5EEC8841A9BF593B681C77BEAB
    SPKI SHA256: C7099DA88F77DB9B6152A29714F31B9B1C75D1D5E48F5FD08A920FF1350B48E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-Osnabrueck RZ-CA G-002

- Subject: countryName=DE, organizationName=Universitaet Osnabrueck, organizationalUnitName=Rechenzentrum, commonName=Uni-Osnabrueck RZ-CA G-002, emailAddress=ca@uni-osnabrueck.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247C57B2A8
- SHA-256: B3FA948C94D2DAD0A0D397B36D5652D78B0982B17A6A6DF55CBEE0AB548D1463
- SPKI SHA-256: C7099DA88F77DB9B6152A29714F31B9B1C75D1D5E48F5FD08A920FF1350B48E7
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401076245160 (0x17a4247c57b2a8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:33 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Osnabrueck, OU = Rechenzentrum, CN = Uni-Osnabrueck RZ-CA G-002, emailAddress = ca@uni-osnabrueck.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                AA:1F:D8:77:15:6E:99:E4:5F:90:D6:EC:63:26:4E:19:EA:67:14:50
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-osnabrueck.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B3FA948C94D2DAD0A0D397B36D5652D78B0982B17A6A6DF55CBEE0AB548D1463
    SPKI SHA256: C7099DA88F77DB9B6152A29714F31B9B1C75D1D5E48F5FD08A920FF1350B48E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-Siegen CA - G02

- Subject: countryName=DE, organizationName=Universitaet Siegen, organizationalUnitName=Zentrum fuer Informations- und Medientechnologie, commonName=Uni-Siegen CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A17433D
- SHA-256: 422D44C7EAEEDF8902B7963601AD93D41A1DD2CE8036341275E58C7485DFB78F
- SPKI SHA-256: 0C90813A67039243033CE2F38C10E93352D6000A66762D32278567BE474AC2AF
- Validity: 2007-03-14 to 2019-03-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 169296701 (0xa17433d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 14 09:51:43 2007 GMT
            Not After : Mar 13 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Siegen, OU = Zentrum fuer Informations- und Medientechnologie, CN = Uni-Siegen CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FF:74:C2:69:3A:F0:84:9F:9C:02:93:CD:9F:9E:F7:DD:FF:01:C5:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 422D44C7EAEEDF8902B7963601AD93D41A1DD2CE8036341275E58C7485DFB78F
    SPKI SHA256: 0C90813A67039243033CE2F38C10E93352D6000A66762D32278567BE474AC2AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-Siegen CA - G02

- Subject: countryName=DE, organizationName=Universitaet Siegen, organizationalUnitName=Zentrum fuer Informations- und Medientechnologie, commonName=Uni-Siegen CA - G02
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060FEE5D9AA
- SHA-256: 63A7745989528C96D35F2D4E3FD71BACBB1CEA03E8EBFB7D88E83DFE4DB5FE92
- SPKI SHA-256: 0C90813A67039243033CE2F38C10E93352D6000A66762D32278567BE474AC2AF
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670732081578 (0x179060fee5d9aa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:22 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Siegen, OU = Zentrum fuer Informations- und Medientechnologie, CN = Uni-Siegen CA - G02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FF:74:C2:69:3A:F0:84:9F:9C:02:93:CD:9F:9E:F7:DD:FF:01:C5:65
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 63A7745989528C96D35F2D4E3FD71BACBB1CEA03E8EBFB7D88E83DFE4DB5FE92
    SPKI SHA256: 0C90813A67039243033CE2F38C10E93352D6000A66762D32278567BE474AC2AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni-Wuppertal CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Wuppertal, organizationName=Bergische Universitaet Wuppertal, organizationalUnitName=ZIM, commonName=Uni-Wuppertal CA, emailAddress=pki@uni-wuppertal.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B4129DC
- SHA-256: D47A3787313FBE36719363CF9879FE668ED19E4DB1FF89579F1A482B54B13319
- SPKI SHA-256: 894AABE20C4B0F55FE31261693303F034D9D3CA12BC3042EAED12F633E1EF357
- Validity: 2007-10-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 188819932 (0xb4129dc)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Oct 26 08:58:53 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Wuppertal, O = Bergische Universitaet Wuppertal, OU = ZIM, CN = Uni-Wuppertal CA, emailAddress = pki@uni-wuppertal.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0B:A4:DB:53:15:14:A2:63:39:08:E1:D4:69:A2:EC:B7:20:79:0C:1A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-wuppertal.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D47A3787313FBE36719363CF9879FE668ED19E4DB1FF89579F1A482B54B13319
    SPKI SHA256: 894AABE20C4B0F55FE31261693303F034D9D3CA12BC3042EAED12F633E1EF357
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Uni-Wuppertal CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Wuppertal, organizationName=Bergische Universitaet Wuppertal, organizationalUnitName=ZIM, commonName=Uni-Wuppertal CA, emailAddress=pki@uni-wuppertal.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42492E2DC69
- SHA-256: 8EF2060892DBD3DB3F1182B4C55B8F607858344D73A8E742B61056B1603CAD44
- SPKI SHA-256: 894AABE20C4B0F55FE31261693303F034D9D3CA12BC3042EAED12F633E1EF357
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401454464105 (0x17a42492e2dc69)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:55 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Wuppertal, O = Bergische Universitaet Wuppertal, OU = ZIM, CN = Uni-Wuppertal CA, emailAddress = pki@uni-wuppertal.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0B:A4:DB:53:15:14:A2:63:39:08:E1:D4:69:A2:EC:B7:20:79:0C:1A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-wuppertal.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8EF2060892DBD3DB3F1182B4C55B8F607858344D73A8E742B61056B1603CAD44
    SPKI SHA256: 894AABE20C4B0F55FE31261693303F034D9D3CA12BC3042EAED12F633E1EF357
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni. Hohenheim CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Universitaet Hohenheim, commonName=Uni. Hohenheim CA - G01, emailAddress=rz-pki@uni-hohenheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF69201B692
- SHA-256: 4CD8D76476BEF3B4C6454CD5F4D743FDC0BE51A973AC3305FB535BBE9DD5A275
- SPKI SHA-256: A25350EA7AD7785F0E310903EE60A91E554D0A4DF5AA36A0906450DC6B0FE909
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398010746514 (0x17aff69201b692)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:50 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Stuttgart, O = Universitaet Hohenheim, CN = Uni. Hohenheim CA - G01, emailAddress = rz-pki@uni-hohenheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                25:B5:79:76:E6:84:34:C5:50:63:9C:41:21:01:44:FE:FD:0F:9B:F1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rz-pki@uni-hohenheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4CD8D76476BEF3B4C6454CD5F4D743FDC0BE51A973AC3305FB535BBE9DD5A275
    SPKI SHA256: A25350EA7AD7785F0E310903EE60A91E554D0A4DF5AA36A0906450DC6B0FE909
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Uni. Hohenheim CA - G01

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Stuttgart, organizationName=Universitaet Hohenheim, commonName=Uni. Hohenheim CA - G01, emailAddress=rz-pki@uni-hohenheim.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CCDF8AF
- SHA-256: 120321D9C4BBB13AB029F58776726B8006CD633D78AE0770B6638E8689B7D870
- SPKI SHA-256: A25350EA7AD7785F0E310903EE60A91E554D0A4DF5AA36A0906450DC6B0FE909
- Validity: 2008-08-22 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 214825135 (0xccdf8af)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 22 08:38:56 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Stuttgart, O = Universitaet Hohenheim, CN = Uni. Hohenheim CA - G01, emailAddress = rz-pki@uni-hohenheim.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                25:B5:79:76:E6:84:34:C5:50:63:9C:41:21:01:44:FE:FD:0F:9B:F1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:rz-pki@uni-hohenheim.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 120321D9C4BBB13AB029F58776726B8006CD633D78AE0770B6638E8689B7D870
    SPKI SHA256: A25350EA7AD7785F0E310903EE60A91E554D0A4DF5AA36A0906450DC6B0FE909
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UniBwM CA-G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Universitaet der Bundeswehr Muenchen, commonName=UniBwM CA-G01, emailAddress=pki@unibw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424AFACED99
- SHA-256: 66CF797A7E2D06314D4C04AE8B7DAAD5951122F21526A39717B06B4248193232
- SPKI SHA-256: A23CFCB3D77F90505B09E8961D4643B40AA6AE064528B1417813A456B71DA237
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401937468825 (0x17a424afaced99)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:23 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Universitaet der Bundeswehr Muenchen, CN = UniBwM CA-G01, emailAddress = pki@unibw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8C:73:7E:60:C9:0C:84:77:30:8A:FD:64:8D:09:84:C0:CC:06:E6:35
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@unibw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 66CF797A7E2D06314D4C04AE8B7DAAD5951122F21526A39717B06B4248193232
    SPKI SHA256: A23CFCB3D77F90505B09E8961D4643B40AA6AE064528B1417813A456B71DA237
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UniBwM CA-G01

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Muenchen, organizationName=Universitaet der Bundeswehr Muenchen, commonName=UniBwM CA-G01, emailAddress=pki@unibw.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C0988B9
- SHA-256: 15F17A6BD400363A99F5901FC13A1C21A949D7D6BBA44266B607FBF0BC956AC3
- SPKI SHA-256: A23CFCB3D77F90505B09E8961D4643B40AA6AE064528B1417813A456B71DA237
- Validity: 2008-03-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 201951417 (0xc0988b9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 26 08:36:59 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Bayern, L = Muenchen, O = Universitaet der Bundeswehr Muenchen, CN = UniBwM CA-G01, emailAddress = pki@unibw.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8C:73:7E:60:C9:0C:84:77:30:8A:FD:64:8D:09:84:C0:CC:06:E6:35
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@unibw.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 15F17A6BD400363A99F5901FC13A1C21A949D7D6BBA44266B607FBF0BC956AC3
    SPKI SHA256: A23CFCB3D77F90505B09E8961D4643B40AA6AE064528B1417813A456B71DA237
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UNIKA-CA

- Subject: countryName=DE, organizationName=Universitaet Karlsruhe, commonName=UNIKA-CA, emailAddress=ca@uni-karlsruhe.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B184A8A
- SHA-256: 1AD8B887BEF68C888C47135F11313E32F5B48D1E81AF1DA5AD0E2CC87954DDF1
- SPKI SHA-256: 62554A30581C7E2DD178EECDB8825BC70EAE741B8F150975A989B4B2D4F7B250
- Validity: 2007-09-25 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 186141322 (0xb184a8a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep 25 08:55:24 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Karlsruhe, CN = UNIKA-CA, emailAddress = ca@uni-karlsruhe.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E7:C0:E1:05:C6:29:45:2D:93:09:E9:2F:9F:90:87:9E:8B:6C:F8:BB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-karlsruhe.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1AD8B887BEF68C888C47135F11313E32F5B48D1E81AF1DA5AD0E2CC87954DDF1
    SPKI SHA256: 62554A30581C7E2DD178EECDB8825BC70EAE741B8F150975A989B4B2D4F7B250
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UniKoeln CA

- Subject: countryName=DE, localityName=Koeln, organizationName=Universitaet zu Koeln, commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A45495D
- SHA-256: 4F512872BE84DB715C5ED7B61C4AC9CC46B040DDBE75F35D5035BA48AEB869F4
- SPKI SHA-256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
- Validity: 2007-04-18 to 2019-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 172312925 (0xa45495d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr 18 07:42:07 2007 GMT
            Not After : Apr 17 00:00:00 2019 GMT
        Subject: C = DE, L = Koeln, O = Universitaet zu Koeln, CN = UniKoeln CA, emailAddress = camaster@uni-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                2A:EA:89:EB:0E:B2:D0:29:C5:FE:F9:4C:A5:76:DC:B7:6F:4F:09:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:camaster@uni-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4F512872BE84DB715C5ED7B61C4AC9CC46B040DDBE75F35D5035BA48AEB869F4
    SPKI SHA256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UniKoeln CA

- Subject: countryName=DE, localityName=Koeln, organizationName=Universitaet zu Koeln, commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1799A020E2B2B0
- SHA-256: 1416359EB6DC17DCAA818E280A788D5DDD1899DB818780AF8545460AC77610ED
- SPKI SHA-256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
- Validity: 2014-05-19 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6642837489889968 (0x1799a020e2b2b0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 19 15:26:08 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Koeln, O = Universitaet zu Koeln, CN = UniKoeln CA, emailAddress = camaster@uni-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2A:EA:89:EB:0E:B2:D0:29:C5:FE:F9:4C:A5:76:DC:B7:6F:4F:09:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:camaster@uni-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1416359EB6DC17DCAA818E280A788D5DDD1899DB818780AF8545460AC77610ED
    SPKI SHA256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UniKoeln CA

- Subject: countryName=DE, organizationName=Universitaet zu Koeln, organizationalUnitName=Zentrum fuer Angewandte Informatik (ZAIK), commonName=UniKoeln CA, emailAddress=camaster@uni-koeln.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179061134CDB81
- SHA-256: 8686D5486C2F33A4A5BB7584F209C848ABE2FB6E8BF47D513440BA1CFD59A827
- SPKI SHA-256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632671074376577 (0x179061134cdb81)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet zu Koeln, OU = Zentrum fuer Angewandte Informatik (ZAIK), CN = UniKoeln CA, emailAddress = camaster@uni-koeln.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2A:EA:89:EB:0E:B2:D0:29:C5:FE:F9:4C:A5:76:DC:B7:6F:4F:09:BA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:camaster@uni-koeln.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8686D5486C2F33A4A5BB7584F209C848ABE2FB6E8BF47D513440BA1CFD59A827
    SPKI SHA256: D5555E437DCF6F39E881B280396F7E0BFD795BAD4FBB6C7ECF7A8920D2790170
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Bayreuth CA (UNIBT-CA) G01

- Subject: countryName=DE, organizationName=Universitaet Bayreuth, commonName=Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress=CA@Uni-Bayreuth.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6C2F5C1C7
- SHA-256: BB45847060389FD2D9F2959D74DEFDAF7EE206E0D00CC76E2784F998CB60C14F
- SPKI SHA-256: DBA2583E5B8C1388C6FE75E624B0436568130E88CBF4C748A7060C678AC08D7D
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398832046535 (0x17aff6c2f5c1c7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:05:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Bayreuth, CN = Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress = CA@Uni-Bayreuth.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8B:09:91:B9:64:B2:73:9B:BC:AB:AD:D4:7C:92:1D:52:DF:75:09:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@Uni-Bayreuth.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB45847060389FD2D9F2959D74DEFDAF7EE206E0D00CC76E2784F998CB60C14F
    SPKI SHA256: DBA2583E5B8C1388C6FE75E624B0436568130E88CBF4C748A7060C678AC08D7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Bayreuth CA (UNIBT-CA) G01

- Subject: countryName=DE, organizationName=Universitaet Bayreuth, commonName=Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress=CA@Uni-Bayreuth.DE
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0F110D74
- SHA-256: 74BC8DD09A7165A6920E9ADC6AFA4890BE253FF6EFDBFD769E0322906055A0F4
- SPKI SHA-256: DBA2583E5B8C1388C6FE75E624B0436568130E88CBF4C748A7060C678AC08D7D
- Validity: 2009-11-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 252775796 (0xf110d74)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  4 14:29:57 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Bayreuth, CN = Universitaet Bayreuth CA (UNIBT-CA) G01, emailAddress = CA@Uni-Bayreuth.DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8B:09:91:B9:64:B2:73:9B:BC:AB:AD:D4:7C:92:1D:52:DF:75:09:6B
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:CA@Uni-Bayreuth.DE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 74BC8DD09A7165A6920E9ADC6AFA4890BE253FF6EFDBFD769E0322906055A0F4
    SPKI SHA256: DBA2583E5B8C1388C6FE75E624B0436568130E88CBF4C748A7060C678AC08D7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Bonn CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Universitaet Bonn, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Bonn CA, emailAddress=caadmin@uni-bonn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B3ED718E
- SHA-256: 9EC652A893B31B42938A8A4CB51197221ED444066B02229D442DD134F0682AA9
- SPKI SHA-256: 3CBC17AD9DFCFED7FB3749186957205313E0A2EB45DB538DF84F811425368433
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402008805774 (0x17a424b3ed718e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:27 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Universitaet Bonn, OU = Hochschulrechenzentrum, CN = Universitaet Bonn CA, emailAddress = caadmin@uni-bonn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EB:37:D0:EB:D7:84:2E:46:9E:12:D3:B3:18:DB:8D:E5:82:E4:68:A7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@uni-bonn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9EC652A893B31B42938A8A4CB51197221ED444066B02229D442DD134F0682AA9
    SPKI SHA256: 3CBC17AD9DFCFED7FB3749186957205313E0A2EB45DB538DF84F811425368433
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Bonn CA

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Universitaet Bonn, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Bonn CA, emailAddress=caadmin@uni-bonn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C140E03
- SHA-256: 849481C25ABCBEA1C0EEF470D1330D7F7069A1608231526B353316DBD948D5E3
- SPKI SHA-256: 3CBC17AD9DFCFED7FB3749186957205313E0A2EB45DB538DF84F811425368433
- Validity: 2008-04-03 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 202640899 (0xc140e03)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 08:08:20 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Universitaet Bonn, OU = Hochschulrechenzentrum, CN = Universitaet Bonn CA, emailAddress = caadmin@uni-bonn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EB:37:D0:EB:D7:84:2E:46:9E:12:D3:B3:18:DB:8D:E5:82:E4:68:A7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@uni-bonn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 849481C25ABCBEA1C0EEF470D1330D7F7069A1608231526B353316DBD948D5E3
    SPKI SHA256: 3CBC17AD9DFCFED7FB3749186957205313E0A2EB45DB538DF84F811425368433
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Bremen CA

- Subject: countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Universitaet Bremen, commonName=Universitaet Bremen CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0F4E8A
- SHA-256: C1642B9BA9A3A787C3E9ADF3B3B62ECF9437F993B6366794BB9B55FEF75C132E
- SPKI SHA-256: BEDECB9A776725188C7F9BA8220AAD946838A28C618E8FCD58DB704E2F8FFB92
- Validity: 2007-03-08 to 2019-03-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168775306 (0xa0f4e8a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  8 09:01:48 2007 GMT
            Not After : Mar  7 00:00:00 2019 GMT
        Subject: C = DE, ST = Bremen, L = Bremen, O = Universitaet Bremen, CN = Universitaet Bremen CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E4:CB:C4:EC:79:D0:DF:AE:6E:AC:92:89:AE:9D:49:2F:C5:E5:98:41
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C1642B9BA9A3A787C3E9ADF3B3B62ECF9437F993B6366794BB9B55FEF75C132E
    SPKI SHA256: BEDECB9A776725188C7F9BA8220AAD946838A28C618E8FCD58DB704E2F8FFB92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Bremen CA

- Subject: countryName=DE, stateOrProvinceName=Bremen, localityName=Bremen, organizationName=Universitaet Bremen, commonName=Universitaet Bremen CA
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F67AC0A4
- SHA-256: 5FEF0E3B4223AFBAEDCD6266BFC5127FEC3890CB54EC893223BCD7AB17F5041D
- SPKI SHA-256: BEDECB9A776725188C7F9BA8220AAD946838A28C618E8FCD58DB704E2F8FFB92
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670590845092 (0x179060f67ac0a4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:14 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Bremen, L = Bremen, O = Universitaet Bremen, CN = Universitaet Bremen CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E4:CB:C4:EC:79:D0:DF:AE:6E:AC:92:89:AE:9D:49:2F:C5:E5:98:41
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5FEF0E3B4223AFBAEDCD6266BFC5127FEC3890CB54EC893223BCD7AB17F5041D
    SPKI SHA256: BEDECB9A776725188C7F9BA8220AAD946838A28C618E8FCD58DB704E2F8FFB92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Duisburg-Essen CA -G01

- Subject: countryName=DE, organizationName=Universitaet Duisburg-Essen, organizationalUnitName=Zentrum fuer Informations- und Mediendienste, commonName=Universitaet Duisburg-Essen CA -G01, emailAddress=caadmin@uni-duisburg-essen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B707E04B
- SHA-256: AA25E0D7FE9564AD5B0E7D2024421EA773E0F507406C91D0BB41E94BAC1698C8
- SPKI SHA-256: A93DA714818861AB025582792C9180C707E001C59A358893D274A775816A83D8
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654402060869707 (0x17a424b707e04b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:31 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Duisburg-Essen, OU = Zentrum fuer Informations- und Mediendienste, CN = Universitaet Duisburg-Essen CA -G01, emailAddress = caadmin@uni-duisburg-essen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                66:66:BC:96:9B:48:4D:E8:DD:BC:22:A7:A6:5B:D5:A8:41:9F:95:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@uni-duisburg-essen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA25E0D7FE9564AD5B0E7D2024421EA773E0F507406C91D0BB41E94BAC1698C8
    SPKI SHA256: A93DA714818861AB025582792C9180C707E001C59A358893D274A775816A83D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Duisburg-Essen CA -G01

- Subject: countryName=DE, organizationName=Universitaet Duisburg-Essen, organizationalUnitName=Zentrum fuer Informations- und Mediendienste, commonName=Universitaet Duisburg-Essen CA -G01, emailAddress=caadmin@uni-duisburg-essen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C1AEF88
- SHA-256: 0D8D6B51CB37D5648E26E08339732EF607E1005829EB3CDA339C9F6592E960BA
- SPKI SHA-256: A93DA714818861AB025582792C9180C707E001C59A358893D274A775816A83D8
- Validity: 2008-04-08 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 203091848 (0xc1aef88)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  8 13:24:10 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Duisburg-Essen, OU = Zentrum fuer Informations- und Mediendienste, CN = Universitaet Duisburg-Essen CA -G01, emailAddress = caadmin@uni-duisburg-essen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                66:66:BC:96:9B:48:4D:E8:DD:BC:22:A7:A6:5B:D5:A8:41:9F:95:EE
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:caadmin@uni-duisburg-essen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0D8D6B51CB37D5648E26E08339732EF607E1005829EB3CDA339C9F6592E960BA
    SPKI SHA256: A93DA714818861AB025582792C9180C707E001C59A358893D274A775816A83D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Erfurt CA - G01

- Subject: countryName=DE, organizationName=Universitaet Erfurt, commonName=Universitaet Erfurt CA - G01, emailAddress=pki@uni-erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AC92B9C
- SHA-256: B5AAF4262A0DBC9430150F7CF7D2E3EC133429A98F6AFD455A8D929670E5992B
- SPKI SHA-256: 38B7A718634915B424A28FB4D33F8228C678739170250E1368EBB3ED42841B4D
- Validity: 2007-07-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 180956060 (0xac92b9c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 27 08:34:23 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Erfurt, CN = Universitaet Erfurt CA - G01, emailAddress = pki@uni-erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EF:77:08:2B:0E:24:5B:68:30:99:E4:56:F1:EA:96:62:C0:53:7C:C7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B5AAF4262A0DBC9430150F7CF7D2E3EC133429A98F6AFD455A8D929670E5992B
    SPKI SHA256: 38B7A718634915B424A28FB4D33F8228C678739170250E1368EBB3ED42841B4D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Erfurt CA - G01

- Subject: countryName=DE, organizationName=Universitaet Erfurt, commonName=Universitaet Erfurt CA - G01, emailAddress=pki@uni-erfurt.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42487B6BA51
- SHA-256: CCABCA996626437D6921A665FF333475879A998C955735BD62FB5F9158C15C74
- SPKI SHA-256: 38B7A718634915B424A28FB4D33F8228C678739170250E1368EBB3ED42841B4D
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401267022417 (0x17a42487b6ba51)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Erfurt, CN = Universitaet Erfurt CA - G01, emailAddress = pki@uni-erfurt.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EF:77:08:2B:0E:24:5B:68:30:99:E4:56:F1:EA:96:62:C0:53:7C:C7
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-erfurt.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CCABCA996626437D6921A665FF333475879A998C955735BD62FB5F9158C15C74
    SPKI SHA256: 38B7A718634915B424A28FB4D33F8228C678739170250E1368EBB3ED42841B4D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Giessen C CA - G01

- Subject: countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen C CA - G01, emailAddress=unigi-ca@uni-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 18D468C7906D45
- SHA-256: 92071ABEC4FF0C5B17D7758C482020B6CBEE3924987C08C2F88112761EFB8235
- SPKI SHA-256: 65D3DD48F9981C237E7B861BD8364402593F0A09CD58160AF1EABCACA461E8D7
- Validity: 2015-01-13 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6988945930874181 (0x18d468c7906d45)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 13 09:53:59 2015 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Giessen, OU = Hochschulrechenzentrum, CN = Universitaet Giessen C CA - G01, emailAddress = unigi-ca@uni-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                6D:15:41:35:22:81:41:B9:C6:85:4A:67:16:38:CE:B5:A1:FF:90:BC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unigi-ca@uni-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 92071ABEC4FF0C5B17D7758C482020B6CBEE3924987C08C2F88112761EFB8235
    SPKI SHA256: 65D3DD48F9981C237E7B861BD8364402593F0A09CD58160AF1EABCACA461E8D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Giessen C CA - G01

- Subject: countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen C CA - G01, emailAddress=unigi-ca@uni-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 109C4834
- SHA-256: 79B09A81006FC59A9B8BC582167A5D48F5D005DE479E4C873793F54037098297
- SPKI SHA-256: 65D3DD48F9981C237E7B861BD8364402593F0A09CD58160AF1EABCACA461E8D7
- Validity: 2010-08-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 278677556 (0x109c4834)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Aug 31 09:25:56 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Giessen, OU = Hochschulrechenzentrum, CN = Universitaet Giessen C CA - G01, emailAddress = unigi-ca@uni-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6D:15:41:35:22:81:41:B9:C6:85:4A:67:16:38:CE:B5:A1:FF:90:BC
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unigi-ca@uni-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 79B09A81006FC59A9B8BC582167A5D48F5D005DE479E4C873793F54037098297
    SPKI SHA256: 65D3DD48F9981C237E7B861BD8364402593F0A09CD58160AF1EABCACA461E8D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Giessen S CA - G01

- Subject: countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen S CA - G01, emailAddress=unigi-ca@uni-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F48359B1
- SHA-256: 351D0B5C5E10A7E93AB826E8F4B0FADBB7A0839EE4D08E040307627B9297EF79
- SPKI SHA-256: A73FB35E8A854C75E524EB9C370B9958541D1DB7A0AB31DC8D3F4CC5BB003F84
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670557854129 (0x179060f48359b1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:12 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Giessen, OU = Hochschulrechenzentrum, CN = Universitaet Giessen S CA - G01, emailAddress = unigi-ca@uni-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0E:7A:B1:61:23:24:B4:B5:0E:0F:E8:52:D5:FC:3E:88:70:89:19:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unigi-ca@uni-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 351D0B5C5E10A7E93AB826E8F4B0FADBB7A0839EE4D08E040307627B9297EF79
    SPKI SHA256: A73FB35E8A854C75E524EB9C370B9958541D1DB7A0AB31DC8D3F4CC5BB003F84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Giessen S CA - G01

- Subject: countryName=DE, organizationName=Universitaet Giessen, organizationalUnitName=Hochschulrechenzentrum, commonName=Universitaet Giessen S CA - G01, emailAddress=unigi-ca@uni-giessen.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0DFF74
- SHA-256: 32626F8F2044FD05AA8F24FBBF582462240DB0AE167BD26E223CEEA7559A13B9
- SPKI SHA-256: A73FB35E8A854C75E524EB9C370B9958541D1DB7A0AB31DC8D3F4CC5BB003F84
- Validity: 2007-03-07 to 2019-03-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168689524 (0xa0dff74)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  7 09:12:06 2007 GMT
            Not After : Mar  6 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Giessen, OU = Hochschulrechenzentrum, CN = Universitaet Giessen S CA - G01, emailAddress = unigi-ca@uni-giessen.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0E:7A:B1:61:23:24:B4:B5:0E:0F:E8:52:D5:FC:3E:88:70:89:19:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:unigi-ca@uni-giessen.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 32626F8F2044FD05AA8F24FBBF582462240DB0AE167BD26E223CEEA7559A13B9
    SPKI SHA256: A73FB35E8A854C75E524EB9C370B9958541D1DB7A0AB31DC8D3F4CC5BB003F84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Halle CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle, organizationName=Martin-Luther-Universitaet Halle-Wittenberg, organizationalUnitName=URZ, commonName=Universitaet Halle CA, emailAddress=pki@uni-halle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42540F20FE9
- SHA-256: 086BD87D9C6CECB1885EA5E4C83F7C45D5BFB61D19F090AE43A4B84141C4E5E3
- SPKI SHA-256: DD7EB6C097F7985F7981DEAD76FFF841D112707145E1B2DEBEFF8F34D751C59F
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654404374695913 (0x17a42540f20fe9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:56:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Halle, O = Martin-Luther-Universitaet Halle-Wittenberg, OU = URZ, CN = Universitaet Halle CA, emailAddress = pki@uni-halle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                21:13:4A:BF:71:4A:8A:88:B1:D0:C3:49:92:7B:D1:E0:C7:43:70:EF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-halle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 086BD87D9C6CECB1885EA5E4C83F7C45D5BFB61D19F090AE43A4B84141C4E5E3
    SPKI SHA256: DD7EB6C097F7985F7981DEAD76FFF841D112707145E1B2DEBEFF8F34D751C59F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Halle CA

- Subject: countryName=DE, stateOrProvinceName=Sachsen-Anhalt, localityName=Halle, organizationName=Martin-Luther-Universitaet Halle-Wittenberg, organizationalUnitName=URZ, commonName=Universitaet Halle CA, emailAddress=pki@uni-halle.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A987083
- SHA-256: 3BB39224C647A429A4D1FF852490C8BBC540529C5E67E1124A8345A666724920
- SPKI SHA-256: DD7EB6C097F7985F7981DEAD76FFF841D112707145E1B2DEBEFF8F34D751C59F
- Validity: 2007-06-20 to 2019-06-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177762435 (0xa987083)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 20 09:27:17 2007 GMT
            Not After : Jun 19 00:00:00 2019 GMT
        Subject: C = DE, ST = Sachsen-Anhalt, L = Halle, O = Martin-Luther-Universitaet Halle-Wittenberg, OU = URZ, CN = Universitaet Halle CA, emailAddress = pki@uni-halle.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                21:13:4A:BF:71:4A:8A:88:B1:D0:C3:49:92:7B:D1:E0:C7:43:70:EF
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-halle.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3BB39224C647A429A4D1FF852490C8BBC540529C5E67E1124A8345A666724920
    SPKI SHA256: DD7EB6C097F7985F7981DEAD76FFF841D112707145E1B2DEBEFF8F34D751C59F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Jena CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Universitaet Jena, commonName=Universitaet Jena CA - G01, emailAddress=pki@uni-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A42482A14E04
- SHA-256: 20120CBB3548416C2D0597AE4F2DA5B855D06D2EBFA04C39D788A8A28CE635B3
- SPKI SHA-256: 0B98EB6417971B4E8A5A6A2A14179420C0D1A4F670DC8AE77234644D30190BAD
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401181732356 (0x17a42482a14e04)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:38 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Universitaet Jena, CN = Universitaet Jena CA - G01, emailAddress = pki@uni-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1A:58:3F:DC:8D:3C:11:E5:54:3E:86:3B:6C:2E:53:B6:7A:AA:49:C4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 20120CBB3548416C2D0597AE4F2DA5B855D06D2EBFA04C39D788A8A28CE635B3
    SPKI SHA256: 0B98EB6417971B4E8A5A6A2A14179420C0D1A4F670DC8AE77234644D30190BAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Jena CA - G01

- Subject: countryName=DE, stateOrProvinceName=Thueringen, localityName=Jena, organizationName=Universitaet Jena, commonName=Universitaet Jena CA - G01, emailAddress=pki@uni-jena.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0AB56DD6
- SHA-256: F933D40BE68841EFCB0D35C0E6E72E774F4EBD3F2BBE2905332FBB6DF42482DC
- SPKI SHA-256: 0B98EB6417971B4E8A5A6A2A14179420C0D1A4F670DC8AE77234644D30190BAD
- Validity: 2007-07-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 179662294 (0xab56dd6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 12 09:11:36 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Thueringen, L = Jena, O = Universitaet Jena, CN = Universitaet Jena CA - G01, emailAddress = pki@uni-jena.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1A:58:3F:DC:8D:3C:11:E5:54:3E:86:3B:6C:2E:53:B6:7A:AA:49:C4
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-jena.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F933D40BE68841EFCB0D35C0E6E72E774F4EBD3F2BBE2905332FBB6DF42482DC
    SPKI SHA256: 0B98EB6417971B4E8A5A6A2A14179420C0D1A4F670DC8AE77234644D30190BAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UNIVERSITAET LEIPZIG CA

- Subject: countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09DFDDBA
- SHA-256: EC05FE651B25A6F048763ACF622F650F9CCBE6B96E691DB8B764BB7652BD575A
- SPKI SHA-256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
- Validity: 2007-01-31 to 2019-01-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165666234 (0x9dfddba)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 31 09:23:56 2007 GMT
            Not After : Jan 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Leipzig, OU = URZ, CN = UNIVERSITAET LEIPZIG CA, emailAddress = pki@uni-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                36:8C:DD:1E:9C:D1:BA:90:80:F8:A7:8A:B7:74:6A:4D:C9:37:DA:0E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EC05FE651B25A6F048763ACF622F650F9CCBE6B96E691DB8B764BB7652BD575A
    SPKI SHA256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### UNIVERSITAET LEIPZIG CA

- Subject: countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4247B56BA55
- SHA-256: 06B933964D107A227DF50B7706040DCD73DF01E63FF221C5AC5C1369551C5C25
- SPKI SHA-256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
- Validity: 2007-01-31 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401059404373 (0x17a4247b56ba55)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 31 09:23:56 2007 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Leipzig, OU = URZ, CN = UNIVERSITAET LEIPZIG CA, emailAddress = pki@uni-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                36:8C:DD:1E:9C:D1:BA:90:80:F8:A7:8A:B7:74:6A:4D:C9:37:DA:0E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 06B933964D107A227DF50B7706040DCD73DF01E63FF221C5AC5C1369551C5C25
    SPKI SHA256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UNIVERSITAET LEIPZIG CA

- Subject: countryName=DE, organizationName=Universitaet Leipzig, organizationalUnitName=URZ, commonName=UNIVERSITAET LEIPZIG CA, emailAddress=pki@uni-leipzig.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A97243F
- SHA-256: A7591E729A3C36710E8049457C71C67620BB12F11DCC77C2692C42635B7F5A57
- SPKI SHA-256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
- Validity: 2007-01-31 to 2019-01-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 177677375 (0xa97243f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jan 31 09:23:56 2007 GMT
            Not After : Jan 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Leipzig, OU = URZ, CN = UNIVERSITAET LEIPZIG CA, emailAddress = pki@uni-leipzig.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                36:8C:DD:1E:9C:D1:BA:90:80:F8:A7:8A:B7:74:6A:4D:C9:37:DA:0E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-leipzig.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A7591E729A3C36710E8049457C71C67620BB12F11DCC77C2692C42635B7F5A57
    SPKI SHA256: C82F41F5384E5E7424A530B6F4D5CF3117B5B6F7420ADF99A957802341D17225
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Oldenburg PKI

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Oldenburg, organizationName=Universitaet Oldenburg, organizationalUnitName=IT-Dienste, commonName=Universitaet Oldenburg PKI, emailAddress=pki@uni-oldenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6DE1F0A33
- SHA-256: 6885F1C0432FD6EAD84BE95FF874980763403C1620DF1F8AFA02D8E0FC939373
- SPKI SHA-256: CF02B9A4229C79BC5DCF43A1FE4632ED3D3756DE36D1033768C56DB9A75A2340
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399287736883 (0x17aff6de1f0a33)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:06 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Oldenburg, O = Universitaet Oldenburg, OU = IT-Dienste, CN = Universitaet Oldenburg PKI, emailAddress = pki@uni-oldenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                18:8F:44:61:DC:DD:78:72:37:D2:F5:B9:05:78:DE:7F:3D:29:CE:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-oldenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6885F1C0432FD6EAD84BE95FF874980763403C1620DF1F8AFA02D8E0FC939373
    SPKI SHA256: CF02B9A4229C79BC5DCF43A1FE4632ED3D3756DE36D1033768C56DB9A75A2340
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Oldenburg PKI

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Oldenburg, organizationName=Universitaet Oldenburg, organizationalUnitName=IT-Dienste, commonName=Universitaet Oldenburg PKI, emailAddress=pki@uni-oldenburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1040038B
- SHA-256: A43E7FFF1AD9A21CE1822F2802307878F35D6F2CE4CAF26997149A1FFB01D177
- SPKI SHA-256: CF02B9A4229C79BC5DCF43A1FE4632ED3D3756DE36D1033768C56DB9A75A2340
- Validity: 2010-06-22 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 272630667 (0x1040038b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 22 09:44:28 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Oldenburg, O = Universitaet Oldenburg, OU = IT-Dienste, CN = Universitaet Oldenburg PKI, emailAddress = pki@uni-oldenburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                18:8F:44:61:DC:DD:78:72:37:D2:F5:B9:05:78:DE:7F:3D:29:CE:E8
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-oldenburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A43E7FFF1AD9A21CE1822F2802307878F35D6F2CE4CAF26997149A1FFB01D177
    SPKI SHA256: CF02B9A4229C79BC5DCF43A1FE4632ED3D3756DE36D1033768C56DB9A75A2340
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Paderborn CA - G01

- Subject: countryName=DE, organizationName=Universitaet Paderborn, organizationalUnitName=IMT (Zentrum fuer Informations- und Medientechnologien), commonName=Universitaet Paderborn CA - G01, emailAddress=ca@uni-paderborn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424A0C8C408
- SHA-256: 6EB38647CEE35E825B4EE08CF30ED0B997879EA79BABC8F2C9FDA2330E9EF8DC
- SPKI SHA-256: 237311FD44FC4EC2338A71F6594E6D72D7B93D92EB0087303CA0D38547A5AEA8
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401687634952 (0x17a424a0c8c408)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:08 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Paderborn, OU = IMT (Zentrum fuer Informations- und Medientechnologien), CN = Universitaet Paderborn CA - G01, emailAddress = ca@uni-paderborn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                81:CF:4C:9A:BC:AF:0F:CB:BE:EC:E0:22:27:4E:29:EF:AE:30:C5:1E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-paderborn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6EB38647CEE35E825B4EE08CF30ED0B997879EA79BABC8F2C9FDA2330E9EF8DC
    SPKI SHA256: 237311FD44FC4EC2338A71F6594E6D72D7B93D92EB0087303CA0D38547A5AEA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Paderborn CA - G01

- Subject: countryName=DE, organizationName=Universitaet Paderborn, organizationalUnitName=IMT (Zentrum fuer Informations- und Medientechnologien), commonName=Universitaet Paderborn CA - G01, emailAddress=ca@uni-paderborn.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B89EFBE
- SHA-256: 71EBEF207A46188CCA8CAC3EA93995310F4080C81DAD72878195FF83AD199DE6
- SPKI SHA-256: 237311FD44FC4EC2338A71F6594E6D72D7B93D92EB0087303CA0D38547A5AEA8
- Validity: 2007-12-20 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 193589182 (0xb89efbe)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 20 13:46:24 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Paderborn, OU = IMT (Zentrum fuer Informations- und Medientechnologien), CN = Universitaet Paderborn CA - G01, emailAddress = ca@uni-paderborn.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                81:CF:4C:9A:BC:AF:0F:CB:BE:EC:E0:22:27:4E:29:EF:AE:30:C5:1E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-paderborn.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 71EBEF207A46188CCA8CAC3EA93995310F4080C81DAD72878195FF83AD199DE6
    SPKI SHA256: 237311FD44FC4EC2338A71F6594E6D72D7B93D92EB0087303CA0D38547A5AEA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Passau CA - G01

- Subject: countryName=DE, localityName=Passau, organizationName=Universitaet Passau, organizationalUnitName=Rechenzentrum, commonName=Universitaet Passau CA - G01, emailAddress=ca@rz.uni-passau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060E542154E
- SHA-256: 2362B0086F417FEBDC7E9AC03009C072D8E8A845FCB3BCE61E50D4F8E37C5E73
- SPKI SHA-256: FF462C52DAB38A6B07D6E7ADBD41C68D7230C1BCBD303F7CEAE60C513FFEE788
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670301918542 (0x179060e542154e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:58 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Passau, O = Universitaet Passau, OU = Rechenzentrum, CN = Universitaet Passau CA - G01, emailAddress = ca@rz.uni-passau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                09:B1:DF:A1:E8:61:5D:A1:CD:C6:F4:83:79:3A:2C:06:0C:8C:EC:08
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.uni-passau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2362B0086F417FEBDC7E9AC03009C072D8E8A845FCB3BCE61E50D4F8E37C5E73
    SPKI SHA256: FF462C52DAB38A6B07D6E7ADBD41C68D7230C1BCBD303F7CEAE60C513FFEE788
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Passau CA - G01

- Subject: countryName=DE, localityName=Passau, organizationName=Universitaet Passau, organizationalUnitName=Rechenzentrum, commonName=Universitaet Passau CA - G01, emailAddress=ca@rz.uni-passau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F93DBB
- SHA-256: B2664F770512F22AABC36907FA5F6F9E7201EAF09ED6FE37DB2597ED3543356C
- SPKI SHA-256: FF462C52DAB38A6B07D6E7ADBD41C68D7230C1BCBD303F7CEAE60C513FFEE788
- Validity: 2007-02-19 to 2019-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167329211 (0x9f93dbb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 19 15:20:12 2007 GMT
            Not After : Feb 18 00:00:00 2019 GMT
        Subject: C = DE, L = Passau, O = Universitaet Passau, OU = Rechenzentrum, CN = Universitaet Passau CA - G01, emailAddress = ca@rz.uni-passau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                09:B1:DF:A1:E8:61:5D:A1:CD:C6:F4:83:79:3A:2C:06:0C:8C:EC:08
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@rz.uni-passau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B2664F770512F22AABC36907FA5F6F9E7201EAF09ED6FE37DB2597ED3543356C
    SPKI SHA256: FF462C52DAB38A6B07D6E7ADBD41C68D7230C1BCBD303F7CEAE60C513FFEE788
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Potsdam CA - G01

- Subject: countryName=DE, localityName=Potsdam, organizationName=Universitaet Potsdam, commonName=Universitaet Potsdam CA - G01, emailAddress=pki-admin@uni-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0B5108CE
- SHA-256: 4A31030AE6B26BE574B119D5A952BE4230756D3388946B6BF0E85C579CF9E83E
- SPKI SHA-256: EB2881867DF6763F5FE50267378B2420CD7BD32F7A7532EE90609630324C2B38
- Validity: 2007-11-07 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 189860046 (0xb5108ce)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Nov  7 09:54:08 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, L = Potsdam, O = Universitaet Potsdam, CN = Universitaet Potsdam CA - G01, emailAddress = pki-admin@uni-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                89:A0:F8:33:75:BF:36:B6:F4:1D:A1:0A:1C:57:0D:E7:7D:69:78:D5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-admin@uni-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4A31030AE6B26BE574B119D5A952BE4230756D3388946B6BF0E85C579CF9E83E
    SPKI SHA256: EB2881867DF6763F5FE50267378B2420CD7BD32F7A7532EE90609630324C2B38
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Potsdam CA - G01

- Subject: countryName=DE, localityName=Potsdam, organizationName=Universitaet Potsdam, commonName=Universitaet Potsdam CA - G01, emailAddress=pki-admin@uni-potsdam.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424954127A6
- SHA-256: 9B5CCC67F96A81AF9D4ED4D5820BFB41D431AA6173B7B812F97E988F6A067B3C
- SPKI SHA-256: EB2881867DF6763F5FE50267378B2420CD7BD32F7A7532EE90609630324C2B38
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401494198182 (0x17a424954127a6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:57 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Potsdam, O = Universitaet Potsdam, CN = Universitaet Potsdam CA - G01, emailAddress = pki-admin@uni-potsdam.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                89:A0:F8:33:75:BF:36:B6:F4:1D:A1:0A:1C:57:0D:E7:7D:69:78:D5
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki-admin@uni-potsdam.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9B5CCC67F96A81AF9D4ED4D5820BFB41D431AA6173B7B812F97E988F6A067B3C
    SPKI SHA256: EB2881867DF6763F5FE50267378B2420CD7BD32F7A7532EE90609630324C2B38
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Stuttgart CA - G01

- Subject: countryName=DE, localityName=Stuttgart, organizationName=Universitaet Stuttgart, commonName=Universitaet Stuttgart CA - G01, emailAddress=ca-g01@uni-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC59
- SHA-256: 284D84715267E291BF6B8470B701E3373312B90ECC2CD6D7AB532EE8BC846818
- SPKI SHA-256: 9D7B18163DC3A8A93C4701DA667D91D589829FFF4D0CCC7517F43FA58A078F6D
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027545 (0xa31ac59)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:07 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, L = Stuttgart, O = Universitaet Stuttgart, CN = Universitaet Stuttgart CA - G01, emailAddress = ca-g01@uni-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BD:AD:27:5A:2C:37:CF:0D:44:1F:72:1A:AA:B7:37:99:11:2E:02:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-g01@uni-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 284D84715267E291BF6B8470B701E3373312B90ECC2CD6D7AB532EE8BC846818
    SPKI SHA256: 9D7B18163DC3A8A93C4701DA667D91D589829FFF4D0CCC7517F43FA58A078F6D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet Stuttgart CA - G01

- Subject: countryName=DE, localityName=Stuttgart, organizationName=Universitaet Stuttgart, commonName=Universitaet Stuttgart CA - G01, emailAddress=ca-g01@uni-stuttgart.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610927C34D
- SHA-256: 2115558AF09C1260F56803098E1888190B8EDB962EC0E25A2715A44CFC7BC037
- SPKI SHA-256: 9D7B18163DC3A8A93C4701DA667D91D589829FFF4D0CCC7517F43FA58A078F6D
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670904173389 (0x1790610927c34d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:33 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, L = Stuttgart, O = Universitaet Stuttgart, CN = Universitaet Stuttgart CA - G01, emailAddress = ca-g01@uni-stuttgart.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BD:AD:27:5A:2C:37:CF:0D:44:1F:72:1A:AA:B7:37:99:11:2E:02:04
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca-g01@uni-stuttgart.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2115558AF09C1260F56803098E1888190B8EDB962EC0E25A2715A44CFC7BC037
    SPKI SHA256: 9D7B18163DC3A8A93C4701DA667D91D589829FFF4D0CCC7517F43FA58A078F6D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Vechta CA - G01

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Universitaet Vechta, organizationalUnitName=Kommunikations- und Informationszentrum, commonName=Universitaet Vechta CA - G01, emailAddress=pki@uni-vechta.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7030D9792
- SHA-256: 8BAB9C9E1409D29762E2F4E9134F8148E13F4F53869D071DDFECF9ED8CCBD0AB
- SPKI SHA-256: BE179183814830EB1A4BE5E8AAA65947C3F7133C4EEF427AF220A86A8EC3D0A8
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399907350418 (0x17aff7030d9792)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:43 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Vechta, O = Universitaet Vechta, OU = Kommunikations- und Informationszentrum, CN = Universitaet Vechta CA - G01, emailAddress = pki@uni-vechta.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                82:24:73:13:BF:99:2C:F8:F5:7C:A7:DD:A1:65:7B:FC:FC:AF:EC:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-vechta.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8BAB9C9E1409D29762E2F4E9134F8148E13F4F53869D071DDFECF9ED8CCBD0AB
    SPKI SHA256: BE179183814830EB1A4BE5E8AAA65947C3F7133C4EEF427AF220A86A8EC3D0A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet Vechta CA - G01

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Vechta, organizationName=Universitaet Vechta, organizationalUnitName=Kommunikations- und Informationszentrum, commonName=Universitaet Vechta CA - G01, emailAddress=pki@uni-vechta.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 139BBDEAABB740
- SHA-256: 013A5399CF6E0E8B8CA44AC1BFE11736EC2755C091E9E6F16FE7624F56FF7FC1
- SPKI SHA-256: BE179183814830EB1A4BE5E8AAA65947C3F7133C4EEF427AF220A86A8EC3D0A8
- Validity: 2012-04-04 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5519264545748800 (0x139bbdeaabb740)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  4 12:36:42 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Vechta, O = Universitaet Vechta, OU = Kommunikations- und Informationszentrum, CN = Universitaet Vechta CA - G01, emailAddress = pki@uni-vechta.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                82:24:73:13:BF:99:2C:F8:F5:7C:A7:DD:A1:65:7B:FC:FC:AF:EC:EA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uni-vechta.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 013A5399CF6E0E8B8CA44AC1BFE11736EC2755C091E9E6F16FE7624F56FF7FC1
    SPKI SHA256: BE179183814830EB1A4BE5E8AAA65947C3F7133C4EEF427AF220A86A8EC3D0A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaet-Goettingen CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Goettingen, organizationName=Georg-August-Universitaet Goettingen, commonName=Universitaet-Goettingen CA, emailAddress=gwdg-ca@gwdg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A4248924915C
- SHA-256: 4A8DC3CD880703F0848D9DC0F050F79A9C48EC45DC64C2222CD65CF446C91367
- SPKI SHA-256: 99AB406C8E692972E38821E5A5779B7F63611E58B29E74C55F850C949A164D40
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401290998108 (0x17a4248924915c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:53:45 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Goettingen, O = Georg-August-Universitaet Goettingen, CN = Universitaet-Goettingen CA, emailAddress = gwdg-ca@gwdg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1D:BD:73:CC:6D:EE:6E:1C:74:70:D9:A3:1B:3A:BA:A8:27:DE:BC:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gwdg-ca@gwdg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4A8DC3CD880703F0848D9DC0F050F79A9C48EC45DC64C2222CD65CF446C91367
    SPKI SHA256: 99AB406C8E692972E38821E5A5779B7F63611E58B29E74C55F850C949A164D40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Universitaet-Goettingen CA

- Subject: countryName=DE, stateOrProvinceName=Niedersachsen, localityName=Goettingen, organizationName=Georg-August-Universitaet Goettingen, commonName=Universitaet-Goettingen CA, emailAddress=gwdg-ca@gwdg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0ACEB1C8
- SHA-256: 6DB35924F9E5735EF9A1BC58C422B42FDA49C6794F8A8ADDCEFDDDB0E4FB2266
- SPKI SHA-256: 99AB406C8E692972E38821E5A5779B7F63611E58B29E74C55F850C949A164D40
- Validity: 2007-07-31 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 181318088 (0xaceb1c8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 31 13:08:09 2007 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Niedersachsen, L = Goettingen, O = Georg-August-Universitaet Goettingen, CN = Universitaet-Goettingen CA, emailAddress = gwdg-ca@gwdg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1D:BD:73:CC:6D:EE:6E:1C:74:70:D9:A3:1B:3A:BA:A8:27:DE:BC:EB
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:gwdg-ca@gwdg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6DB35924F9E5735EF9A1BC58C422B42FDA49C6794F8A8ADDCEFDDDB0E4FB2266
    SPKI SHA256: 99AB406C8E692972E38821E5A5779B7F63611E58B29E74C55F850C949A164D40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaetsklinikum Freiburg CA - G01

- Subject: countryName=DE, organizationName=Universitaetsklinikum Freiburg, organizationalUnitName=Klinikrechenzentrum, commonName=Universitaetsklinikum Freiburg CA - G01, emailAddress=pki@uniklinik-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 13FFD41057FAFA
- SHA-256: FA74DC7DFB579A47006D7E7B65440AFB557C24D1F0A29A2A0EB4CB5AF755DAB3
- SPKI SHA-256: 7A613A116FF6CA588430C73C41034151C52D18213E16CCD7DD67116C714B6E42
- Validity: 2012-06-19 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5629310829853434 (0x13ffd41057fafa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun 19 10:37:52 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaetsklinikum Freiburg, OU = Klinikrechenzentrum, CN = Universitaetsklinikum Freiburg CA - G01, emailAddress = pki@uniklinik-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                6F:B0:8E:5E:33:46:F0:1D:CA:A9:F2:3C:F8:DA:13:69:EF:35:C5:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uniklinik-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA74DC7DFB579A47006D7E7B65440AFB557C24D1F0A29A2A0EB4CB5AF755DAB3
    SPKI SHA256: 7A613A116FF6CA588430C73C41034151C52D18213E16CCD7DD67116C714B6E42
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Universitaetsklinikum Freiburg CA - G01

- Subject: countryName=DE, organizationName=Universitaetsklinikum Freiburg, organizationalUnitName=Klinikrechenzentrum, commonName=Universitaetsklinikum Freiburg CA - G01, emailAddress=pki@uniklinik-freiburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF7077A2153
- SHA-256: F85D813B9FD2C6867B267FDACD1C82342D96746B107C18EA3FBEEB20CFB4E265
- SPKI SHA-256: 7A613A116FF6CA588430C73C41034151C52D18213E16CCD7DD67116C714B6E42
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399981572435 (0x17aff7077a2153)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:47 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaetsklinikum Freiburg, OU = Klinikrechenzentrum, CN = Universitaetsklinikum Freiburg CA - G01, emailAddress = pki@uniklinik-freiburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                6F:B0:8E:5E:33:46:F0:1D:CA:A9:F2:3C:F8:DA:13:69:EF:35:C5:21
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@uniklinik-freiburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F85D813B9FD2C6867B267FDACD1C82342D96746B107C18EA3FBEEB20CFB4E265
    SPKI SHA256: 7A613A116FF6CA588430C73C41034151C52D18213E16CCD7DD67116C714B6E42
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UNIVERSITAETSmedizin. Mainz - CA - G01

- Subject: countryName=DE, stateOrProvinceName=Rheinland-Pfalz, localityName=Mainz, organizationName=Universitaetsmedizin der Johannes Gutenberg-Universitaet Mainz, commonName=UNIVERSITAETSmedizin. Mainz - CA - G01, emailAddress=ca@unimedizin-mainz.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17DF58AB795A46
- SHA-256: 21FF4B498A9BDF897B1CFFA7EA9F5E560A2BB3C036E810A47F32E63845DB0D31
- SPKI SHA-256: 15ED3B75C42B974DD661F8483BD5237C69D6771E97C7D8E6669A4E61F6F8AADF
- Validity: 2014-07-11 to 2019-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6719496391318086 (0x17df58ab795a46)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 11 12:39:55 2014 GMT
            Not After : Jul  6 00:00:00 2019 GMT
        Subject: C = DE, ST = Rheinland-Pfalz, L = Mainz, O = Universitaetsmedizin der Johannes Gutenberg-Universitaet Mainz, CN = UNIVERSITAETSmedizin. Mainz - CA - G01, emailAddress = ca@unimedizin-mainz.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A4:39:4E:22:6D:C6:2A:06:20:6E:DA:E8:68:51:5C:A5:81:0E:76:3D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@unimedizin-mainz.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 21FF4B498A9BDF897B1CFFA7EA9F5E560A2BB3C036E810A47F32E63845DB0D31
    SPKI SHA256: 15ED3B75C42B974DD661F8483BD5237C69D6771E97C7D8E6669A4E61F6F8AADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UNIWUE-CA - G01

- Subject: countryName=DE, organizationName=Universitaet Wuerzburg, commonName=UNIWUE-CA - G01, emailAddress=ca@uni-wuerzburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060F3098F03
- SHA-256: A4BDD5D78189077F80191CDCBBE0F093C10206DABB913922B5BB2FC41DCCC0CC
- SPKI SHA-256: 5A28C9E3298391A76E9D1144684FE05281B370E6921678034BC92C61364A66A9
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670533095171 (0x179060f3098f03)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Wuerzburg, CN = UNIWUE-CA - G01, emailAddress = ca@uni-wuerzburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7D:1F:A8:40:F6:A6:F6:32:4E:81:E5:F8:32:0B:C3:6D:2B:C4:33:6E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-wuerzburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A4BDD5D78189077F80191CDCBBE0F093C10206DABB913922B5BB2FC41DCCC0CC
    SPKI SHA256: 5A28C9E3298391A76E9D1144684FE05281B370E6921678034BC92C61364A66A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UNIWUE-CA - G01

- Subject: countryName=DE, organizationName=Universitaet Wuerzburg, commonName=UNIWUE-CA - G01, emailAddress=ca@uni-wuerzburg.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A0DFF68
- SHA-256: E06C3AF4EA837D9E6346ECFFF832BF7B6FCBFC5A5EF3CD37B04496F87B9BEDF8
- SPKI SHA-256: 5A28C9E3298391A76E9D1144684FE05281B370E6921678034BC92C61364A66A9
- Validity: 2007-03-07 to 2019-03-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 168689512 (0xa0dff68)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar  7 09:11:54 2007 GMT
            Not After : Mar  6 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Wuerzburg, CN = UNIWUE-CA - G01, emailAddress = ca@uni-wuerzburg.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7D:1F:A8:40:F6:A6:F6:32:4E:81:E5:F8:32:0B:C3:6D:2B:C4:33:6E
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-wuerzburg.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E06C3AF4EA837D9E6346ECFFF832BF7B6FCBFC5A5EF3CD37B04496F87B9BEDF8
    SPKI SHA256: 5A28C9E3298391A76E9D1144684FE05281B370E6921678034BC92C61364A66A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### WHZ Zwickau CA

- Subject: countryName=DE, organizationName=Westsaechsische Hochschule Zwickau, commonName=WHZ Zwickau CA, emailAddress=WHZCA@fh-zwickau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0C0988DE
- SHA-256: 5CC3752460CE5C47CB883BC7042857E099292B27172065C88A48C73C57F045FB
- SPKI SHA-256: C33392FDD887E7E29F77962C668EB2E7F5E48BC38F88DC97AD1C714BB376D789
- Validity: 2008-03-26 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 201951454 (0xc0988de)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 26 08:37:36 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = Westsaechsische Hochschule Zwickau, CN = WHZ Zwickau CA, emailAddress = WHZCA@fh-zwickau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3D:9C:A1:19:9F:8D:43:32:2A:65:C6:BB:42:0B:E5:B9:F1:9F:1A:78
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:WHZCA@fh-zwickau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5CC3752460CE5C47CB883BC7042857E099292B27172065C88A48C73C57F045FB
    SPKI SHA256: C33392FDD887E7E29F77962C668EB2E7F5E48BC38F88DC97AD1C714BB376D789
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### WHZ Zwickau CA

- Subject: countryName=DE, organizationName=Westsaechsische Hochschule Zwickau, commonName=WHZ Zwickau CA, emailAddress=WHZCA@fh-zwickau.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17A424B011FE86
- SHA-256: EE42B2151C55AD65B0DD2ACE0E57E5AA71EF8A7BC86049354CA41F909CF39204
- SPKI SHA-256: C33392FDD887E7E29F77962C668EB2E7F5E48BC38F88DC97AD1C714BB376D789
- Validity: 2014-05-27 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6654401944092294 (0x17a424b011fe86)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 27 14:54:25 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Westsaechsische Hochschule Zwickau, CN = WHZ Zwickau CA, emailAddress = WHZCA@fh-zwickau.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3D:9C:A1:19:9F:8D:43:32:2A:65:C6:BB:42:0B:E5:B9:F1:9F:1A:78
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:WHZCA@fh-zwickau.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE42B2151C55AD65B0DD2ACE0E57E5AA71EF8A7BC86049354CA41F909CF39204
    SPKI SHA256: C33392FDD887E7E29F77962C668EB2E7F5E48BC38F88DC97AD1C714BB376D789
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### WZB CA

- Subject: countryName=DE, organizationName=Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, organizationalUnitName=DV, commonName=WZB CA, emailAddress=certs@wzb.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060D62673F6
- SHA-256: 87ACDD1CFCF73610A7F73247C67D8F9F371BDBB85EF39C60E2A65D9F278E118B
- SPKI SHA-256: 622FD37A3C3728A6838D26C2A3FA438DECB08E45EACC3F7FCA931A182BA17AA2
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670048449526 (0x179060d62673f6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:42 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, OU = DV, CN = WZB CA, emailAddress = certs@wzb.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                72:3D:78:47:89:F7:43:CA:BE:CF:88:A7:78:9E:2B:C7:B1:19:A5:C0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:certs@wzb.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 87ACDD1CFCF73610A7F73247C67D8F9F371BDBB85EF39C60E2A65D9F278E118B
    SPKI SHA256: 622FD37A3C3728A6838D26C2A3FA438DECB08E45EACC3F7FCA931A182BA17AA2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### WZB CA

- Subject: countryName=DE, organizationName=Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, organizationalUnitName=DV, commonName=WZB CA, emailAddress=certs@wzb.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E15512
- SHA-256: 3417DA6D883470FBE921D840AC569DA303A6B99984225BD6DB9378776A98910D
- SPKI SHA-256: 622FD37A3C3728A6838D26C2A3FA438DECB08E45EACC3F7FCA931A182BA17AA2
- Validity: 2007-02-01 to 2019-01-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 165762322 (0x9e15512)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  1 12:05:24 2007 GMT
            Not After : Jan 31 00:00:00 2019 GMT
        Subject: C = DE, O = Wissenschaftszentrum Berlin fuer Sozialforschung gGmbH, OU = DV, CN = WZB CA, emailAddress = certs@wzb.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                72:3D:78:47:89:F7:43:CA:BE:CF:88:A7:78:9E:2B:C7:B1:19:A5:C0
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:certs@wzb.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3417DA6D883470FBE921D840AC569DA303A6B99984225BD6DB9378776A98910D
    SPKI SHA256: 622FD37A3C3728A6838D26C2A3FA438DECB08E45EACC3F7FCA931A182BA17AA2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ZALF CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Muencheberg, organizationName=Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., commonName=ZALF CA, emailAddress=pki@zalf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6965792B9
- SHA-256: 1D3D30FB8F1945C3A28307D2FE0D38D418BA05AD7201FA0A77058133302A314E
- SPKI SHA-256: 8C26627F5DC712FC4F4E7F0473BB4794DC5F0339B70553C2AFE90ADD1B3987E1
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667398083482297 (0x17aff6965792b9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:04:54 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Muencheberg, O = Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., CN = ZALF CA, emailAddress = pki@zalf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                16:C4:6E:0D:3B:F8:95:76:60:19:23:5F:36:FC:93:93:79:66:F4:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@zalf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1D3D30FB8F1945C3A28307D2FE0D38D418BA05AD7201FA0A77058133302A314E
    SPKI SHA256: 8C26627F5DC712FC4F4E7F0473BB4794DC5F0339B70553C2AFE90ADD1B3987E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZALF CA

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Muencheberg, organizationName=Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., commonName=ZALF CA, emailAddress=pki@zalf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0CE074D3
- SHA-256: 0A5751D2DDAFE753E204FBD83DAA4ED8C436C4894F956EEC18A265A38A87C3E3
- SPKI SHA-256: 8C26627F5DC712FC4F4E7F0473BB4794DC5F0339B70553C2AFE90ADD1B3987E1
- Validity: 2008-09-05 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 216036563 (0xce074d3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Sep  5 09:09:24 2008 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Muencheberg, O = Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V., CN = ZALF CA, emailAddress = pki@zalf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:C4:6E:0D:3B:F8:95:76:60:19:23:5F:36:FC:93:93:79:66:F4:96
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@zalf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0A5751D2DDAFE753E204FBD83DAA4ED8C436C4894F956EEC18A265A38A87C3E3
    SPKI SHA256: 8C26627F5DC712FC4F4E7F0473BB4794DC5F0339B70553C2AFE90ADD1B3987E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ZBW CA - G01

- Subject: countryName=DE, organizationName=ZBW - Leibniz-Informationszentrum Wirtschaft, commonName=ZBW CA - G01, emailAddress=ca@zbw.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 14E94DB4DF5FCA
- SHA-256: 3138A65F1D4B73F465ABF8F90C2E7D22B7C213B46DDC0DD889454B86A33D812D
- SPKI SHA-256: 048E497B504B46E00B395407703BC1A3A5A8C235179F5F97833A314D38CD21AD
- Validity: 2012-12-13 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5886019490504650 (0x14e94db4df5fca)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Dec 13 12:55:00 2012 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, O = ZBW - Leibniz-Informationszentrum Wirtschaft, CN = ZBW CA - G01, emailAddress = ca@zbw.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:28:93:04:36:13:34:EE:16:3B:48:63:1B:74:63:B7:10:CB:8E:9A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zbw.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3138A65F1D4B73F465ABF8F90C2E7D22B7C213B46DDC0DD889454B86A33D812D
    SPKI SHA256: 048E497B504B46E00B395407703BC1A3A5A8C235179F5F97833A314D38CD21AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZBW CA - G01

- Subject: countryName=DE, organizationName=ZBW - Leibniz-Informationszentrum Wirtschaft, commonName=ZBW CA - G01, emailAddress=ca@zbw.eu
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF710289F6C
- SHA-256: AF1C1DBC9AFC113F4E9611663B78B1A8B9321BD629F1D865B0172D9324E57EB6
- SPKI SHA-256: 048E497B504B46E00B395407703BC1A3A5A8C235179F5F97833A314D38CD21AD
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400127225708 (0x17aff710289f6c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:56 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = ZBW - Leibniz-Informationszentrum Wirtschaft, CN = ZBW CA - G01, emailAddress = ca@zbw.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                2E:28:93:04:36:13:34:EE:16:3B:48:63:1B:74:63:B7:10:CB:8E:9A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zbw.eu
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AF1C1DBC9AFC113F4E9611663B78B1A8B9321BD629F1D865B0172D9324E57EB6
    SPKI SHA256: 048E497B504B46E00B395407703BC1A3A5A8C235179F5F97833A314D38CD21AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle der TUM

- Subject: countryName=DE, organizationName=Technische Universitaet Muenchen, commonName=Zertifizierungsstelle der TUM
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060DFF401D9
- SHA-256: 8CB4382313CBC196113293F495CA412F589CE10C0D4158C33DE2CBAAB670AE31
- SPKI SHA-256: 4B0750A072FB481FFAA35D97B0885B409F5B00D5676EB2681D32F396EFEA5D3D
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670212915673 (0x179060dff401d9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:51 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Muenchen, CN = Zertifizierungsstelle der TUM
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9D:9F:23:F0:19:1B:7E:C7:23:5D:27:2A:CC:A5:36:3A:A6:69:E5:89
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8CB4382313CBC196113293F495CA412F589CE10C0D4158C33DE2CBAAB670AE31
    SPKI SHA256: 4B0750A072FB481FFAA35D97B0885B409F5B00D5676EB2681D32F396EFEA5D3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle der TUM

- Subject: countryName=DE, organizationName=Technische Universitaet Muenchen, commonName=Zertifizierungsstelle der TUM
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09F10A63
- SHA-256: 4AA9127803D1C9825FFF00F7BDECB5EF789E4C6A9155B171C7238687370DFD4C
- SPKI SHA-256: 4B0750A072FB481FFAA35D97B0885B409F5B00D5676EB2681D32F396EFEA5D3D
- Validity: 2007-02-13 to 2019-02-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166791779 (0x9f10a63)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 13 10:03:01 2007 GMT
            Not After : Feb 12 00:00:00 2019 GMT
        Subject: C = DE, O = Technische Universitaet Muenchen, CN = Zertifizierungsstelle der TUM
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9D:9F:23:F0:19:1B:7E:C7:23:5D:27:2A:CC:A5:36:3A:A6:69:E5:89
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4AA9127803D1C9825FFF00F7BDECB5EF789E4C6A9155B171C7238687370DFD4C
    SPKI SHA256: 4B0750A072FB481FFAA35D97B0885B409F5B00D5676EB2681D32F396EFEA5D3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle des UKSH

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, organizationName=Universitaetsklinikum Schleswig-Holstein, organizationalUnitName=ITSG, commonName=Zertifizierungsstelle des UKSH, emailAddress=ca@uk-sh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF6E3D5289F
- SHA-256: C91AA8FE0F5B0EC0DDA1C4A43BE860B6BFB8EC8FBB8F03DECBFA6B8633092C37
- SPKI SHA-256: 48EAEBA2A733878F870666D744E40EA1F8674138C8DCCB97787CA2634162B7C0
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667399383558303 (0x17aff6e3d5289f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:06:11 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, O = Universitaetsklinikum Schleswig-Holstein, OU = ITSG, CN = Zertifizierungsstelle des UKSH, emailAddress = ca@uk-sh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                91:02:03:31:B2:B9:AE:7A:5A:BE:6E:1E:F7:D0:78:C6:BA:65:D7:FA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uk-sh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C91AA8FE0F5B0EC0DDA1C4A43BE860B6BFB8EC8FBB8F03DECBFA6B8633092C37
    SPKI SHA256: 48EAEBA2A733878F870666D744E40EA1F8674138C8DCCB97787CA2634162B7C0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle des UKSH

- Subject: countryName=DE, stateOrProvinceName=Schleswig-Holstein, organizationName=Universitaetsklinikum Schleswig-Holstein, organizationalUnitName=ITSG, commonName=Zertifizierungsstelle des UKSH, emailAddress=ca@uk-sh.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 106E1EF5
- SHA-256: 818686BC502CDB7894B2906FDAF4815BA3E541450627EA38DE24F4A8AEBE395F
- SPKI SHA-256: 48EAEBA2A733878F870666D744E40EA1F8674138C8DCCB97787CA2634162B7C0
- Validity: 2010-07-27 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 275652341 (0x106e1ef5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jul 27 09:05:43 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Schleswig-Holstein, O = Universitaetsklinikum Schleswig-Holstein, OU = ITSG, CN = Zertifizierungsstelle des UKSH, emailAddress = ca@uk-sh.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                91:02:03:31:B2:B9:AE:7A:5A:BE:6E:1E:F7:D0:78:C6:BA:65:D7:FA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uk-sh.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 818686BC502CDB7894B2906FDAF4815BA3E541450627EA38DE24F4A8AEBE395F
    SPKI SHA256: 48EAEBA2A733878F870666D744E40EA1F8674138C8DCCB97787CA2634162B7C0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle FH Duesseldorf - G02

- Subject: countryName=DE, organizationName=FH Duesseldorf, organizationalUnitName=DVZ, commonName=Zertifizierungsstelle FH Duesseldorf - G02, emailAddress=pki@fh-duesseldorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A31AC70
- SHA-256: D27E9B96694290C0C9BD8B13B07C0AC142C784C7D698CCA40C67672103D818AB
- SPKI SHA-256: D311C1F2AC6859AD558EFF5A091176170FDA1407742DF3848A52504DD4A466AA
- Validity: 2007-04-03 to 2019-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 171027568 (0xa31ac70)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Apr  3 10:39:30 2007 GMT
            Not After : Apr  2 00:00:00 2019 GMT
        Subject: C = DE, O = FH Duesseldorf, OU = DVZ, CN = Zertifizierungsstelle FH Duesseldorf - G02, emailAddress = pki@fh-duesseldorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9E:F3:03:D1:20:E7:21:EA:71:48:5D:11:43:06:55:78:F9:C8:0E:E6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-duesseldorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D27E9B96694290C0C9BD8B13B07C0AC142C784C7D698CCA40C67672103D818AB
    SPKI SHA256: D311C1F2AC6859AD558EFF5A091176170FDA1407742DF3848A52504DD4A466AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle FH Duesseldorf - G02

- Subject: countryName=DE, organizationName=FH Duesseldorf, organizationalUnitName=DVZ, commonName=Zertifizierungsstelle FH Duesseldorf - G02, emailAddress=pki@fh-duesseldorf.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1790610C586A51
- SHA-256: 67999A0DF4A040BCDCB84CE31D0E63EC5A039C0A9B3194C41589FF89CC3AF8E3
- SPKI SHA-256: D311C1F2AC6859AD558EFF5A091176170FDA1407742DF3848A52504DD4A466AA
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670957693521 (0x1790610c586a51)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:36 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = FH Duesseldorf, OU = DVZ, CN = Zertifizierungsstelle FH Duesseldorf - G02, emailAddress = pki@fh-duesseldorf.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9E:F3:03:D1:20:E7:21:EA:71:48:5D:11:43:06:55:78:F9:C8:0E:E6
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:pki@fh-duesseldorf.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 67999A0DF4A040BCDCB84CE31D0E63EC5A039C0A9B3194C41589FF89CC3AF8E3
    SPKI SHA256: D311C1F2AC6859AD558EFF5A091176170FDA1407742DF3848A52504DD4A466AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle Universitaet Muenster - G02

- Subject: countryName=DE, organizationName=Universitaet Muenster, commonName=Zertifizierungsstelle Universitaet Muenster - G02, emailAddress=ca@uni-muenster.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0A02236E
- SHA-256: 2B0F480111B47C1A5B90F68462F8DCE787206FCDD4D1FBD14CEA65C0FD543F88
- SPKI SHA-256: C9D3DA8267E71B1705E25113367E7354B781447C78713373749DBC90982FBF0B
- Validity: 2007-02-26 to 2019-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 167912302 (0xa02236e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 26 09:18:23 2007 GMT
            Not After : Feb 25 00:00:00 2019 GMT
        Subject: C = DE, O = Universitaet Muenster, CN = Zertifizierungsstelle Universitaet Muenster - G02, emailAddress = ca@uni-muenster.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BE:9E:51:A2:C9:92:7C:BB:60:8B:E6:B0:68:64:77:5A:52:19:A1:00
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-muenster.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2B0F480111B47C1A5B90F68462F8DCE787206FCDD4D1FBD14CEA65C0FD543F88
    SPKI SHA256: C9D3DA8267E71B1705E25113367E7354B781447C78713373749DBC90982FBF0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Zertifizierungsstelle Universitaet Muenster - G02

- Subject: countryName=DE, organizationName=Universitaet Muenster, commonName=Zertifizierungsstelle Universitaet Muenster - G02, emailAddress=ca@uni-muenster.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060EBAE9B8C
- SHA-256: D19946AC6EA78CC2A4D2EE9FA91235C833B5D8CF839EDA3637C1AF076391E91F
- SPKI SHA-256: C9D3DA8267E71B1705E25113367E7354B781447C78713373749DBC90982FBF0B
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670409694092 (0x179060ebae9b8c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:06:03 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Universitaet Muenster, CN = Zertifizierungsstelle Universitaet Muenster - G02, emailAddress = ca@uni-muenster.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BE:9E:51:A2:C9:92:7C:BB:60:8B:E6:B0:68:64:77:5A:52:19:A1:00
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@uni-muenster.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D19946AC6EA78CC2A4D2EE9FA91235C833B5D8CF839EDA3637C1AF076391E91F
    SPKI SHA256: C9D3DA8267E71B1705E25113367E7354B781447C78713373749DBC90982FBF0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZIB-CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), commonName=ZIB-CA, emailAddress=ca@zib.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 0DB24449
- SHA-256: 6CDDD436865DB1D4162FBD5BECF60C362C391280FE14B5BCF6702D44557D2852
- SPKI SHA-256: 75753B489C1420D3CC9876C65A105173398BC7CE31A10AF30334B9184F862FBC
- Validity: 2009-02-11 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 229786697 (0xdb24449)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb 11 12:38:17 2009 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), CN = ZIB-CA, emailAddress = ca@zib.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:89:B4:69:ED:46:BC:A6:CB:D0:12:D7:66:AA:7A:F9:0A:E7:F6:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zib.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6CDDD436865DB1D4162FBD5BECF60C362C391280FE14B5BCF6702D44557D2852
    SPKI SHA256: 75753B489C1420D3CC9876C65A105173398BC7CE31A10AF30334B9184F862FBC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ZIB-CA

- Subject: countryName=DE, stateOrProvinceName=Berlin, localityName=Berlin, organizationName=Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), commonName=ZIB-CA, emailAddress=ca@zib.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF75F6D14A2
- SHA-256: 065629825892F0E677246A2CF4AF4F912EF383152D40592A97FA4DCA8D55DDB6
- SPKI SHA-256: 75753B489C1420D3CC9876C65A105173398BC7CE31A10AF30334B9184F862FBC
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667401457112226 (0x17aff75f6d14a2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:08:15 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Berlin, L = Berlin, O = Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB), CN = ZIB-CA, emailAddress = ca@zib.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B1:89:B4:69:ED:46:BC:A6:CB:D0:12:D7:66:AA:7A:F9:0A:E7:F6:B1
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zib.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 065629825892F0E677246A2CF4AF4F912EF383152D40592A97FA4DCA8D55DDB6
    SPKI SHA256: 75753B489C1420D3CC9876C65A105173398BC7CE31A10AF30334B9184F862FBC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZIVIT CA - G01

- Subject: countryName=DE, organizationName=Zentrum fuer Informationsverarbeitung und Informationstechnik, organizationalUnitName=Betrieb, commonName=ZIVIT CA - G01, emailAddress=ca@zivit.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 09E6B590
- SHA-256: 278292CFCD89AF6312E39E8AC70C21B9A2A7EE68FF825B93FF3332F08285EA07
- SPKI SHA-256: A0792F0C677D3877456F36E3BC2D40C3938F911C74C4452B84D4432BC4BFAD72
- Validity: 2007-02-05 to 2019-02-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 166114704 (0x9e6b590)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Feb  5 13:58:26 2007 GMT
            Not After : Feb  4 00:00:00 2019 GMT
        Subject: C = DE, O = Zentrum fuer Informationsverarbeitung und Informationstechnik, OU = Betrieb, CN = ZIVIT CA - G01, emailAddress = ca@zivit.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7E:E2:36:30:AB:42:39:C0:9A:1B:85:C2:72:0D:AB:7C:0B:E1:B2:6A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zivit.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 278292CFCD89AF6312E39E8AC70C21B9A2A7EE68FF825B93FF3332F08285EA07
    SPKI SHA256: A0792F0C677D3877456F36E3BC2D40C3938F911C74C4452B84D4432BC4BFAD72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ZIVIT CA - G01

- Subject: countryName=DE, organizationName=Zentrum fuer Informationsverarbeitung und Informationstechnik, organizationalUnitName=Betrieb, commonName=ZIVIT CA - G01, emailAddress=ca@zivit.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 179060DC09622A
- SHA-256: A5037806C817E44C42FE88A9E866A26C47F8449FFBFB08259FA48A810B08D780
- SPKI SHA-256: A0792F0C677D3877456F36E3BC2D40C3938F911C74C4452B84D4432BC4BFAD72
- Validity: 2014-05-12 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6632670147207722 (0x179060dc09622a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: May 12 15:05:48 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, O = Zentrum fuer Informationsverarbeitung und Informationstechnik, OU = Betrieb, CN = ZIVIT CA - G01, emailAddress = ca@zivit.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7E:E2:36:30:AB:42:39:C0:9A:1B:85:C2:72:0D:AB:7C:0B:E1:B2:6A
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zivit.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A5037806C817E44C42FE88A9E866A26C47F8449FFBFB08259FA48A810B08D780
    SPKI SHA256: A0792F0C677D3877456F36E3BC2D40C3938F911C74C4452B84D4432BC4BFAD72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZKM-EDV

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Zentrum fuer Kunst und Medientechnologie Karlsruhe, organizationalUnitName=EDV, commonName=ZKM-EDV, emailAddress=edv@zkm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 1025EB6B
- SHA-256: F2C90E0CD1ED468411D35A1F19CE596357ACEC01C1A231DE3629B609134AE4E4
- SPKI SHA-256: 456351B6F5C2DF28B172A9768E9F265BE61F85B3685DD2447652F10C70119D71
- Validity: 2010-06-02 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 270920555 (0x1025eb6b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  2 14:42:36 2010 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Zentrum fuer Kunst und Medientechnologie Karlsruhe, OU = EDV, CN = ZKM-EDV, emailAddress = edv@zkm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                72:56:EA:06:24:FF:55:E0:22:FF:21:DE:8E:33:0D:D1:74:85:41:DA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:edv@zkm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F2C90E0CD1ED468411D35A1F19CE596357ACEC01C1A231DE3629B609134AE4E4
    SPKI SHA256: 456351B6F5C2DF28B172A9768E9F265BE61F85B3685DD2447652F10C70119D71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### ZKM-EDV

- Subject: countryName=DE, stateOrProvinceName=Baden-Wuerttemberg, localityName=Karlsruhe, organizationName=Zentrum fuer Kunst und Medientechnologie Karlsruhe, organizationalUnitName=EDV, commonName=ZKM-EDV, emailAddress=edv@zkm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 17AFF73F5555D9
- SHA-256: 07F130B3970380F07A496A065BC4700D7CE36F7546CFC296D8891FD8D28C1EDF
- SPKI SHA-256: 456351B6F5C2DF28B172A9768E9F265BE61F85B3685DD2447652F10C70119D71
- Validity: 2014-06-05 to 2019-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6667400918685145 (0x17aff73f5555d9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Jun  5 14:07:44 2014 GMT
            Not After : Jul  9 23:59:00 2019 GMT
        Subject: C = DE, ST = Baden-Wuerttemberg, L = Karlsruhe, O = Zentrum fuer Kunst und Medientechnologie Karlsruhe, OU = EDV, CN = ZKM-EDV, emailAddress = edv@zkm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                72:56:EA:06:24:FF:55:E0:22:FF:21:DE:8E:33:0D:D1:74:85:41:DA
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:edv@zkm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 07F130B3970380F07A496A065BC4700D7CE36F7546CFC296D8891FD8D28C1EDF
    SPKI SHA256: 456351B6F5C2DF28B172A9768E9F265BE61F85B3685DD2447652F10C70119D71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ZZF Potsdam CA - G01

- Subject: countryName=DE, stateOrProvinceName=Brandenburg, localityName=Potsdam, organizationName=Zentrum fuer Zeithistorische Forschung Potsdam e.V. (ZZF), commonName=ZZF Potsdam CA - G01, emailAddress=ca@zzf-pdm.de
- Issuer: countryName=DE, organizationName=DFN-Verein, organizationalUnitName=DFN-PKI, commonName=DFN-Verein PCA Global - G01
- Serial: 19211475DF989C
- SHA-256: AADAC9F2EC9BD7C4BBE448DD70F8633571A79B2486AF71DFCF0DBA57639A638E
- SPKI SHA-256: C3B987202FC448CB94BBEC24BFA1F4A21B8B9A2878B1FA6246B1F9EE6F9DF672
- Validity: 2015-03-12 to 2019-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- CRL DP: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7073246178416796 (0x19211475df989c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = DFN-Verein, OU = DFN-PKI, CN = DFN-Verein PCA Global - G01
        Validity
            Not Before: Mar 12 13:38:45 2015 GMT
            Not After : Jun 30 00:00:00 2019 GMT
        Subject: C = DE, ST = Brandenburg, L = Potsdam, O = Zentrum fuer Zeithistorische Forschung Potsdam e.V. (ZZF), CN = ZZF Potsdam CA - G01, emailAddress = ca@zzf-pdm.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.22177.300.30
                Policy: 1.3.6.1.4.1.22177.300.1.1.4
            X509v3 Subject Key Identifier:
                BF:32:F6:02:93:F5:AF:81:F3:B1:E0:5E:EC:E1:D1:35:9B:4B:16:2D
            X509v3 Authority Key Identifier:
                49:B7:C6:CF:E8:3D:1F:7F:EA:44:7B:13:29:F7:F1:0A:70:3E:DE:64
            X509v3 Subject Alternative Name:
                email:ca@zzf-pdm.de
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
                Full Name:
                  URI:http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.pca.dfn.de/OCSP-Server/OCSP
                CA Issuers - URI:http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
                CA Issuers - URI:http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AADAC9F2EC9BD7C4BBE448DD70F8633571A79B2486AF71DFCF0DBA57639A638E
    SPKI SHA256: C3B987202FC448CB94BBEC24BFA1F4A21B8B9A2878B1FA6246B1F9EE6F9DF672
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.22177.300.30, 1.3.6.1.4.1.22177.300.1.1.4
- AIA OCSP: http://ocsp.pca.dfn.de/OCSP-Server/OCSP
- AIA CA Issuers: http://cdp1.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt, http://cdp2.pca.dfn.de/global-root-ca/pub/cacert/cacert.crt
- CRL Distribution Points: http://cdp1.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl, http://cdp2.pca.dfn.de/global-root-ca/pub/crl/cacrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired
