# CA Owner Audit Dump - GlobalSign nv-sa

Generated: 2026-07-28T18:05:13.174069Z

## CA Owner Summary

- Name: GlobalSign nv-sa
- Country: Belgium
- Website: -
- Problem Reporting: report-abuse[at]globalsign[dot]com
- CP/CPS URLs: https://www.globalsign.com/en/repository/., https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf, https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf, https://pki.goog/repo/cp-cps-smime/6.7/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-tls/6.8/GTS-CP-CPS-TLS.html, https://www.ecert.gov.hk/product/cps/ecert/img/server_cps_en28.pdf, https://www.ecert.gov.hk/product/cps/ecert/img/server_cps_en28.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bd1c24dd-3825-459b-a98f-38192e939fcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e22e872f-ec7c-4c2b-b0ea-6bc1771f4316, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2ada7687-891a-461e-b9d3-730cc5113dc0, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e93adaf2-39da-406c-bd10-1e0c22d27650, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=832a4fc9-4c21-4da1-86d6-d096ee44fc62
- Root Programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: report-abuse[at]globalsign[dot]com
- CP/CPS URLs: https://www.globalsign.com/en/repository/., https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf, https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf, https://pki.goog/repo/cp-cps-smime/6.7/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-tls/6.8/GTS-CP-CPS-TLS.html, https://www.ecert.gov.hk/product/cps/ecert/img/server_cps_en28.pdf, https://www.ecert.gov.hk/product/cps/ecert/img/server_cps_en28.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bd1c24dd-3825-459b-a98f-38192e939fcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e22e872f-ec7c-4c2b-b0ea-6bc1771f4316, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2ada7687-891a-461e-b9d3-730cc5113dc0, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e93adaf2-39da-406c-bd10-1e0c22d27650, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=832a4fc9-4c21-4da1-86d6-d096ee44fc62
- Repository URLs: https://www.globalsign.com/en/repository, https://pki.goog/, https://www.ecert.gov.hk/product/cps/ecert/index.html
- Root programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign | yes | unknown | 2014-12-10 to 2034-12-10 | - | - | - | current errors: 1 |
| 2 | organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign | yes | unknown | 2012-11-13 to 2038-01-19 | - | - | - | current errors: 1 |
| 3 | organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign | yes | unknown | 2009-03-18 to 2029-03-18 | - | - | - | clean |
| 4 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 5 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 6 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root E45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 7 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 8 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 9 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 10 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA | yes | unknown | 1998-09-01 to 2028-01-28 | - | - | - | clean |
| 11 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46 | yes | unknown | 2019-03-20 to 2046-03-20 | - | - | - | clean |
| 12 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46 | yes | unknown | 2019-03-20 to 2046-03-20 | - | - | - | clean |
| 13 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root E45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 14 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 15 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46 | yes | unknown | 2021-03-24 to 2046-03-24 | - | - | - | clean |
| 16 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45 | yes | unknown | 2020-03-18 to 2045-03-18 | - | - | - | clean |
| 17 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root E41 | yes | unknown | 2026-03-31 to 2041-03-31 | - | - | - | current errors: 1 |
| 18 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root R41 | yes | unknown | 2026-03-31 to 2041-03-31 | - | - | - | clean |
| 19 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Verified Mark Root R42 | yes | unknown | 2023-11-15 to 2042-11-15 | - | - | - | clean |
| 20 | countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie AATL ICA 2020 | yes | revoked | 2020-01-22 to 2029-04-30 | 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 21 | countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R45 AATL CA 2022 | yes | expired | 2022-01-26 to 2025-01-26 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 22 | countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R45 AATL CA 2025 | yes | current | 2025-01-22 to 2030-01-22 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 23 | countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R6 AATL ICA 2020 | yes | current | 2020-08-19 to 2030-08-19 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 24 | countryName=BR, organizationName=Ministerio da Defesa, commonName=AC Defesa GR3 OV TLS CA 2023 | yes | current | 2023-02-22 to 2027-02-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 25 | countryName=BR, organizationName=Ministerio da Defesa, commonName=AC Defesa GR46 OV TLS CA 2025 | yes | current | 2025-08-20 to 2029-08-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 26 | countryName=BR, organizationName=SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), commonName=AC SERPRO AR46 OV TLS CA 2025 | yes | current | 2025-10-15 to 2030-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication | clean |
| 27 | countryName=US, stateOrProvinceName=DE, organizationName=Accenture Federal Services LLC, commonName=Accenture Federal Services External CA | yes | revoked, expired | 2017-09-20 to 2022-09-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 28 | countryName=US, organizationName=Accenture Federal Services LLC, commonName=Accenture Federal Services GCC R3 Global CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 29 | countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2021 | yes | expired | 2021-11-17 to 2024-11-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 30 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2023 | yes | current | 2023-04-19 to 2026-11-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 31 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2025 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 32 | countryName=CN, organizationName=Aliyun Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2021 | yes | revoked, expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 33 | countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2021 | yes | expired | 2021-11-17 to 2024-11-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 34 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2023 | yes | current | 2023-04-19 to 2026-11-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 35 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 OV TLS CA 2023 | yes | current | 2023-04-19 to 2026-11-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 36 | countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 TLS OV CA 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 37 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R46 AlphaSSL CA 2025 | yes | current | 2025-07-16 to 2030-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 38 | countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R46 DV TLS CA 2025 | yes | current | 2025-07-16 to 2030-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 39 | organizationalUnitName=Alpha CA, organizationName=Alpha, commonName=Alpha CA | yes | expired | 2007-04-11 to 2017-04-11 | 1.3.6.1.4.1.4146.1.10.10 | 0 | - | clean |
| 40 | organizationalUnitName=Alpha CA, organizationName=Alpha, commonName=Alpha CA | yes | expired | 2007-04-11 to 2017-04-11 | 1.3.6.1.4.1.4146.1.10.10 | 0 | Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 41 | organizationName=AlphaSSL, commonName=AlphaSSL CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 42 | organizationName=AlphaSSL, commonName=AlphaSSL CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 43 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2 | yes | expired | 2016-10-14 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 44 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2 | yes | expired | 2014-02-20 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 45 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2 | yes | expired | 2014-02-20 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 46 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G3 | yes | revoked, expired | 2015-09-04 to 2025-09-04 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 47 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G4 | yes | current | 2022-10-12 to 2027-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 48 | countryName=US, organizationName=ATT Services Inc, commonName=ATT Atlas R3 OV TLS CA 2020 | yes | current | 2020-07-28 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 49 | countryName=US, organizationName=ATT Services Inc, organizationalUnitName=ATT Business Wi-Fi Services, localityName=Austin, stateOrProvinceName=Texas, commonName=ATT Organization Validated CA 2019 | yes | revoked | 2019-05-15 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 50 | commonName=ATT Wi-Fi Services Root Certificate Authority, organizationalUnitName=ATT Wi-Fi Services, organizationName=ATT Services Inc, countryName=US | yes | revoked, expired | 2011-10-19 to 2021-10-19 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4552.509.1.1 | 1 | - | clean |
| 51 | countryName=BR, organizationName=Banco Votorantim S.A., commonName=Banco Votorantim SA GR6 EV TLS CA 2024 | yes | current | 2024-11-20 to 2029-11-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 52 | countryName=IL, stateOrProvinceName=Tel Aviv, localityName=Tel Aviv-Jaffa, organizationName=Beame.io Ltd, commonName=Beame.io CA 1 | yes | expired | 2016-07-20 to 2021-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 53 | countryName=IL, organizationName=Beame.io Ltd, commonName=Beame.io CA 1 | yes | expired | 2020-07-05 to 2021-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 54 | countryName=IL, stateOrProvinceName=Tel Aviv, localityName=Tel Aviv-Jaffa, organizationName=Beame.io Ltd, commonName=Beame.io CA 2 | yes | unknown | 2016-08-17 to 2026-08-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 55 | countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022 | yes | current | 2022-11-16 to 2032-11-16 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection | clean |
| 56 | countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022 | yes | current | 2023-06-28 to 2032-11-16 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection | clean |
| 57 | countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022 | yes | current | 2024-05-15 to 2032-11-16 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 58 | countryName=BE, commonName=Belgium Root CA2 | yes | revoked | 2007-10-04 to 2028-01-28 | 2.16.56.9.1.1 | - | - | clean |
| 59 | countryName=US, organizationName=BAH, organizationalUnitName=Components, commonName=Booz Allen Hamilton CA 2 | yes | revoked, expired | 2008-12-17 to 2018-12-17 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 60 | countryName=US, stateOrProvinceName=MD, organizationName=CareFirst, Inc., commonName=CareFirst SHA256 CA - G2 | yes | revoked, expired | 2017-08-23 to 2022-08-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 61 | countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM Atlas R45 SMIME CA 2025 | yes | current | 2025-03-19 to 2030-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 62 | countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 63 | countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 64 | countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, localityName=ARAXA, stateOrProvinceName=MINAS GERAIS, streetAddress=RUA CORREGO DA MATA S/N, postalCode=38183-903, commonName=CBMM SMIME CA 2019 | yes | revoked | 2019-04-30 to 2028-04-30 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 65 | countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, localityName=ARAXA, stateOrProvinceName=MINAS GERAIS, streetAddress=RUA CORREGO DA MATA S/N, postalCode=38183-903, commonName=CBMM SMIME CA 2019 | yes | revoked | 2019-04-30 to 2028-04-30 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6 | clean |
| 66 | countryName=US, organizationName=Chenega Corporation, commonName=Chenega Root CA | yes | revoked, expired | 2010-06-17 to 2020-06-17 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35724.509.1.1, 1.3.6.1.4.1.35724.509.1.2, 1.3.6.1.4.1.35724.509.1.3 | 2 | - | clean |
| 67 | countryName=TW, organizationName=Chunghwa Telecom Co., Ltd., commonName=Chunghwa Telecom GCC R46 OV TLS CA 2025 | yes | current | 2025-07-16 to 2030-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 68 | countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022 | yes | current | 2023-06-28 to 2032-11-16 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 69 | countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022 | yes | current | 2022-11-16 to 2032-11-16 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 70 | countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022 | yes | current | 2024-05-15 to 2032-11-16 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 71 | countryName=US, stateOrProvinceName=CA, localityName=San Francisco, organizationName=Cloudflare, Inc., commonName=Cloudflare ECC DV CA | yes | revoked, expired | 2018-02-13 to 2023-02-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 72 | countryName=US, stateOrProvinceName=CA, localityName=San Francisco, organizationName=Cloudflare, Inc., commonName=Cloudflare RSA DV CA | yes | revoked, expired | 2018-02-13 to 2023-02-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 73 | countryName=ZM, organizationName=Common Market for Eastern and Southern Africa Secretariat, commonName=COMESA GCC R45 SMIME CA 2021 | yes | revoked | 2023-06-28 to 2028-07-14 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection | clean |
| 74 | countryName=ZM, organizationName=Common Market for Eastern and Southern Africa Secretariat, commonName=COMESA GCC R45 SMIME CA 2021 | yes | revoked | 2021-07-14 to 2028-07-14 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection | clean |
| 75 | countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA | yes | expired | 2014-12-10 to 2017-12-10 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 76 | countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA | yes | expired | 2015-08-19 to 2018-08-19 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 77 | countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA | yes | expired | 2014-11-26 to 2017-11-26 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 78 | countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA | yes | expired | 2014-11-25 to 2017-11-25 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 79 | countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group Atlas R45 SMIME CA 2025 | yes | current | 2025-01-22 to 2030-01-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 80 | countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 81 | countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 82 | countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group SMIME CA 2019 | yes | revoked | 2019-10-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 83 | countryName=US, organizationName=CrowdStrike, Inc., commonName=CrowdStrike Atlas R46 OV TLS CA 2026 | yes | current | 2026-05-20 to 2029-05-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 84 | countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike GCC R3 TLS OV CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 85 | countryName=US, organizationName=CrowdStrike, Inc., commonName=CrowdStrike GCC R46 OV TLS CA 2026 | yes | current | 2026-06-24 to 2029-06-23 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 86 | countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike GCC R6 OV TLS CA 2024 | yes | current | 2024-07-17 to 2030-07-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 87 | countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike OV SSL Issuing CA 2020 | yes | unknown | 2020-05-20 to 2027-04-25 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | current errors: 1 |
| 88 | countryName=AE, stateOrProvinceName=Abu Dhabi, localityName=Abu Dhabi, organizationName=Crown Prince Court, commonName=Crown Prince Court CA | yes | revoked, expired | 2012-12-13 to 2017-12-13 | 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 3 |
| 89 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS DV CA 2021 | yes | expired | 2021-04-21 to 2024-04-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 90 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS EV CA 2021 | yes | expired | 2021-04-21 to 2024-04-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 91 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS OV CA 2021 | yes | expired | 2021-04-21 to 2024-04-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 92 | countryName=DK, organizationName=Danske Bank A/S, organizationalUnitName=Messaging Security, commonName=Danske Bank Group | yes | revoked, expired | 2010-12-10 to 2020-12-10 | 1.3.6.1.4.1.4146.1.60 | 0 | - | clean |
| 93 | countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 94 | countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 95 | countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global SMIME CA 2019 | yes | revoked | 2019-10-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 96 | countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Client Auth CA I6 | yes | current | 2025-03-19 to 2035-03-19 | 1.3.6.1.4.1.4146.10.2.2 | 0 | TLS Web Client Authentication | clean |
| 97 | countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Global TLS CA I6 | yes | current | 2025-09-17 to 2035-09-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.2 | 0 | TLS Web Server Authentication | clean |
| 98 | countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Secure Mail CA I6 | yes | current | 2025-03-19 to 2035-03-19 | 2.23.140.1.5.3.3, 2.23.140.1.5.2.3, 1.3.6.1.4.1.4146.10.3.1, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection | clean |
| 99 | countryName=DE, organizationName=Deutsche Post AG, localityName=Bonn, stateOrProvinceName=Nordrhein-Westfalen, commonName=DPDHL Global TLS CA - I4 | yes | revoked | 2019-08-21 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 100 | countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL Global TLS CA - I5 | yes | current | 2020-07-11 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 101 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3 | yes | revoked, expired | 2013-09-03 to 2018-09-03 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 102 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3 | yes | revoked, expired | 2014-09-03 to 2019-09-03 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 103 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationalUnitName=IT Services, organizationName=Deutsche Post DHL, commonName=DPDHL TLS CA I3 | yes | revoked, expired | 2013-04-18 to 2018-04-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 104 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3 | yes | revoked, expired | 2013-07-16 to 2018-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 105 | DPDHL TLS CA I3 | no | revoked, expired | 2015-07-09 to 2020-07-09 | - | - | - | not_available |
| 106 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CT CA I3 | yes | revoked, expired | 2018-09-19 to 2023-09-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 107 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS SHA2 CA I3 | yes | revoked, expired | 2018-02-13 to 2023-02-13 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 108 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL User CA I3 | yes | expired | 2019-06-19 to 2020-07-31 | 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 109 | countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL User CA I3 | yes | expired | 2018-02-13 to 2023-02-13 | 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 110 | countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I4 | yes | revoked | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 111 | countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5 | yes | current | 2024-05-15 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 112 | countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 113 | countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5 | yes | current | 2020-07-28 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 114 | countryName=GT, organizationName=DSIGNER, SOCIEDAD ANÓNIMA, commonName=DSigner GCC R3 SMIME CA 2020 | yes | current | 2020-10-21 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 115 | countryName=GT, organizationName=DSIGNER, SOCIEDAD ANÓNIMA, commonName=DSigner GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 116 | countryName=US, stateOrProvinceName=New York, organizationName=EmblemHealth, Inc., commonName=EmblemHealth SHA256 CA - G3 | yes | revoked, expired | 2016-07-20 to 2021-07-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 117 | countryName=CZ, organizationName=European GNSS Agency (GSA), commonName=European GNSS Agency Atlas R45 SMIME CA 2021 | yes | current | 2021-02-24 to 2028-02-24 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 118 | countryName=SK, organizationName=European Labour Authority, commonName=European Labour Authority Atlas R45 SMIME CA 2024 | yes | current | 2024-10-16 to 2034-10-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 119 | countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021 | yes | current | 2021-08-18 to 2028-08-18 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 120 | countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021 | yes | current | 2023-06-28 to 2028-08-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 121 | countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021 | yes | current | 2024-05-15 to 2028-08-18 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 122 | countryName=GB, organizationName=Ernst & Young LLP, commonName=EY LLP GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 123 | countryName=GB, organizationName=Ernst & Young LLP, commonName=EY LLP SHA256 CA - G2 | yes | revoked, expired | 2018-11-21 to 2023-11-21 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 124 | countryName=CR, organizationName=FIFCO, commonName=FIFCO Atlas R45 SMIME CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 125 | commonName=Ford Motor Company - Enterprise CA | yes | revoked, expired | 2007-12-05 to 2017-12-05 | 1.3.6.1.4.1.4146.1.60 | - | - | clean |
| 126 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01 | yes | revoked, expired | 2017-09-20 to 2022-09-20 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 127 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01 | yes | expired | 2015-03-26 to 2020-03-26 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 128 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01 | yes | revoked, expired | 2016-04-20 to 2020-09-16 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 129 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01 | yes | expired | 2015-09-16 to 2020-09-16 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 130 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01 | yes | expired | 2018-01-17 to 2023-01-17 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 131 | countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company – Enterprise Issuing CA01 | yes | expired | 2015-02-25 to 2020-02-25 | 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12 | historical errors: 2 |
| 132 | domainComponent=edu, domainComponent=gemini, countryName=US, organizationalUnitName=Information Systems Group, organizationName=AURA - Gemini Observatory, commonName=GEMINI-CA | yes | revoked, expired | 2008-09-24 to 2018-09-24 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 133 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | revoked, expired | 2014-12-10 to 2019-12-10 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 134 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | expired | 2017-08-23 to 2022-08-23 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 135 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | revoked, expired | 2014-05-28 to 2019-05-28 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 136 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | revoked, expired | 2015-08-19 to 2020-08-19 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 2 |
| 137 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | revoked, expired | 2020-12-09 to 2022-08-23 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 1 |
| 138 | countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA | yes | revoked, expired | 2014-11-25 to 2019-11-25 | 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60 | 0 | OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 3 |
| 139 | countryName=DE, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient Corporate CA | yes | revoked, expired | 2008-12-17 to 2018-12-17 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 140 | organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign | yes | expired | 2009-11-18 to 2019-03-18 | 2.5.29.32.0 | - | - | clean |
| 141 | organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2018-09-19 to 2028-01-28 | 2.5.29.32.0 | - | - | current errors: 2 |
| 142 | organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2019-06-19 to 2028-01-28 | 2.5.29.32.0 | - | - | current errors: 2 |
| 143 | organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2009-03-18 to 2028-01-28 | 2.5.29.32.0 | - | - | clean |
| 144 | organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2019-06-19 to 2028-01-28 | 2.5.29.32.0 | - | - | current errors: 2 |
| 145 | organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign | yes | revoked | 2006-12-15 to 2028-01-28 | 2.5.29.32.0 | - | - | clean |
| 146 | organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2018-11-21 to 2029-03-18 | 2.5.29.32.0 | - | - | current errors: 2 |
| 147 | organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign | yes | expired | 2009-11-18 to 2019-03-18 | 2.5.29.32.0 | - | - | clean |
| 148 | organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign | yes | current | 2019-02-20 to 2029-03-18 | 2.5.29.32.0 | - | - | current errors: 2 |
| 149 | organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign | yes | revoked | 2006-12-15 to 2028-01-28 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto | clean |
| 150 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign 4096 Administration CA | yes | revoked, expired | 2015-05-20 to 2020-05-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 151 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign AATL Partners CA 2019 | yes | revoked | 2019-04-30 to 2029-04-30 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | - | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 152 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 AATL CA 2026 | yes | current | 2026-01-21 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 153 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Client Authentication CA 2025 | yes | current | 2025-03-19 to 2035-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 154 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Authentication CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2031-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 155 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Non QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2031-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 156 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2031-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 157 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | current | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 158 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas E45 UK Qualified Remote Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2030-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 159 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-06-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 160 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 161 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 162 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 163 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 164 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | not_available |
| 165 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q1 | yes | revoked, expired | 2021-05-19 to 2024-03-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 166 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q2 | yes | revoked, expired | 2021-05-19 to 2024-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 167 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q3 | yes | revoked, expired | 2021-05-19 to 2024-09-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 168 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q4 | yes | revoked, expired | 2021-05-19 to 2024-12-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 169 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q1 | yes | revoked, expired | 2022-03-23 to 2025-03-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 170 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q2 | yes | revoked, expired | 2022-03-23 to 2025-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 171 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q3 | yes | revoked, expired | 2022-03-23 to 2025-09-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 172 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q4 | yes | revoked, expired | 2022-03-23 to 2025-12-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 173 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 174 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 175 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 176 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 177 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 178 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 179 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 180 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 181 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 182 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 183 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 184 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 185 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 186 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 187 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 188 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 189 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 190 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 191 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 192 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 193 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | not_available |
| 194 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 195 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-06-30 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 196 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 197 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 198 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 199 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 200 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | not_available |
| 201 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 Qualified Timestamping CA 2022 | yes | current | 2022-05-18 to 2037-05-18 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 202 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 TimeStamping CA 2022 | yes | current | 2022-12-07 to 2039-12-07 | 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30 | 0 | Time Stamping | clean |
| 203 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 204 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 205 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 206 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 207 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 208 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 209 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 210 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 211 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 212 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 213 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 214 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 215 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 216 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 217 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA H1 2021 | yes | expired | 2021-02-24 to 2024-02-24 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 218 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 219 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2020 | yes | revoked | 2020-08-19 to 2030-08-19 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 220 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2020-12 | yes | expired | 2020-12-09 to 2022-12-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 221 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 222 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 223 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 224 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 225 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 226 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 227 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 228 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 229 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 230 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 231 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 232 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 233 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 234 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 235 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 236 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 237 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 LT | yes | current | 2026-07-22 to 2029-07-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | not_available |
| 238 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 239 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 240 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 241 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 242 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 243 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 244 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 245 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 246 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 247 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 248 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 249 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 250 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 251 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 252 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 253 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 254 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 255 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 256 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2020-12 | yes | expired | 2020-12-09 to 2022-12-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 257 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 258 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 259 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 260 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 261 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 262 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 263 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 264 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 265 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 266 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 267 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 268 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 269 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 270 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 271 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 272 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 273 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 LT | yes | current | 2026-07-22 to 2029-07-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | not_available |
| 274 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 275 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 276 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 277 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 278 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-07-28 to 2035-07-28 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 279 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas ECCR5 UK Qualified Timestamping CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2035-09-16 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 280 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R1 EV TLS CA 2023 | yes | current | 2023-09-20 to 2028-01-28 | 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 281 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 282 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 283 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 284 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 285 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 286 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 287 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 288 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 289 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 290 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 291 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 292 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 293 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 294 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 295 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 296 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 297 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 298 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 299 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 300 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA H1 2021 | yes | expired | 2021-03-24 to 2024-03-24 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 301 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 302 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 303 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 304 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 305 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 306 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 307 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 308 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 309 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 310 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 311 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 312 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 313 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 314 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 315 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 316 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA H1 2021 | yes | expired | 2021-02-24 to 2024-02-24 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 317 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 318 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2020 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 319 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2020-12 | yes | expired | 2020-12-09 to 2022-12-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 320 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 321 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 322 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 323 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 324 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 325 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 326 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 327 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 328 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 329 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 330 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 331 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 332 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 333 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 334 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 335 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 336 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 LT | yes | current | 2026-07-22 to 2029-03-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | not_available |
| 337 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 338 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 339 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 340 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 341 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q1 | yes | revoked, expired | 2021-05-19 to 2024-03-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 342 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q2 | yes | revoked, expired | 2021-05-19 to 2024-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 343 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q3 | yes | revoked, expired | 2021-05-19 to 2024-09-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 344 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q4 | yes | revoked, expired | 2021-05-19 to 2024-12-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 345 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 346 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 347 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 348 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 349 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 350 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 351 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 352 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 353 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 354 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 355 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 356 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 357 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 358 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 359 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2020-12 | yes | expired | 2020-12-09 to 2022-12-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 360 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 361 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 362 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 363 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 364 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 365 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 366 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 367 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 368 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 369 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 370 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 371 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 372 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 373 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 374 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 375 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 376 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 LT | yes | current | 2026-07-22 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | not_available |
| 377 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 378 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 379 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 380 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 381 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 SMIME CA 2020 | yes | current | 2020-07-28 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 382 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 AATL CA 2020 | yes | current | 2020-09-16 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 383 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 AATL CA 2026 | yes | current | 2026-01-21 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 384 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Client Authentication CA 2025 | yes | current | 2025-03-19 to 2035-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 385 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Authentication CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2027-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 386 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Non QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2027-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 387 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2021-05-19 to 2027-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 388 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 389 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Remote Signing CA 2024, organizationIdentifier=NTRBE-0459134256 | yes | current | 2024-02-21 to 2030-02-21 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 390 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 391 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Timestamping CA 2024, organizationIdentifier=NTRBE-0459134256 | yes | current | 2024-02-21 to 2030-02-21 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 392 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Remote QSCD Delegated RA CA 2022, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2022-03-23 to 2028-03-23 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 393 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 SMIME CA 2025 | yes | current | 2025-08-20 to 2032-08-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 394 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 TimeStamping CA 2022 | yes | current | 2022-12-07 to 2039-12-07 | 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30 | 0 | Time Stamping | clean |
| 395 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas R45 UK Qualified Remote Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2026-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 396 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas R45 UK Qualified Timestamping CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2026-09-16 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 397 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2025 Q3 | yes | current | 2025-04-16 to 2027-06-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 398 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 399 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 400 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 401 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 402 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-06-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 403 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 404 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 405 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 406 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 407 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | not_available |
| 408 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q1 | yes | revoked, expired | 2022-03-23 to 2025-03-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 409 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q2 | yes | revoked, expired | 2022-03-23 to 2025-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 410 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q3 | yes | revoked, expired | 2022-03-23 to 2025-09-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 411 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q4 | yes | revoked, expired | 2022-03-23 to 2025-12-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 412 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 413 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 414 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 415 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 416 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 417 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 418 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 419 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 420 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 421 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 422 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 423 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 424 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 425 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 426 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 427 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 428 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 429 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 430 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 431 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 432 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | not_available |
| 433 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 434 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-06-30 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 435 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 436 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 437 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 438 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 439 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q4 | yes | current | 2026-07-22 to 2028-07-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | not_available |
| 440 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 AATL CA 2020 | yes | expired | 2020-12-09 to 2022-03-09 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 441 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 442 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q1 | yes | expired | 2021-10-20 to 2024-10-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 443 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q2 | yes | expired | 2022-01-26 to 2025-01-26 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 444 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q3 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 445 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q4 | yes | expired | 2022-07-20 to 2024-07-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 446 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q1 | yes | expired | 2022-10-12 to 2024-10-12 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 447 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q2 | yes | expired | 2023-01-18 to 2025-01-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 448 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q3 | yes | expired | 2023-04-19 to 2025-04-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 449 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q4 | yes | expired | 2023-07-19 to 2025-07-19 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 450 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q1 | yes | expired | 2023-10-18 to 2025-10-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 451 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q2 | yes | expired | 2024-01-17 to 2026-01-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 452 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q3 | yes | expired | 2024-04-17 to 2026-04-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 453 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q4 | yes | expired | 2024-07-17 to 2026-07-17 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 454 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q1 | yes | current | 2024-10-16 to 2026-10-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 455 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q2 | yes | current | 2025-01-22 to 2027-01-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 456 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q3 | yes | current | 2025-04-16 to 2027-04-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 457 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q4 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 458 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 LT | yes | current | 2026-07-22 to 2029-07-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | not_available |
| 459 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q1 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 460 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q2 | yes | current | 2026-01-21 to 2028-01-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 461 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q3 | yes | current | 2026-04-22 to 2028-04-22 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 462 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA H2 2021 | yes | expired | 2021-06-16 to 2024-06-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 463 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 SMIME CA 2023 | yes | current | 2023-04-19 to 2032-04-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 464 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 2 for AATL | yes | revoked, expired | 2014-12-10 to 2024-12-10 | 2.5.29.32.0 | 0 | - | clean |
| 465 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 2 for AATL | yes | revoked, expired | 2014-11-25 to 2024-11-25 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 466 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 3 for AATL | yes | revoked, expired | 2014-11-25 to 2024-11-25 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 467 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 3 for AATL | yes | revoked, expired | 2014-12-10 to 2024-12-10 | 2.5.29.32.0 | 0 | - | clean |
| 468 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 4 for AATL | yes | revoked | 2019-02-20 to 2029-02-20 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.30.2 | 0 | OCSP Signing, E-mail Protection, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 469 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 4 for AATL | yes | revoked | 2018-04-18 to 2028-04-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 470 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 5 for AATL | yes | revoked | 2018-04-18 to 2028-04-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 471 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 6 for AATL | yes | revoked | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 472 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2 | yes | current | 2014-02-20 to 2029-03-18 | 2.5.29.32.0 | 1 | - | current errors: 1 |
| 473 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2 | yes | revoked, expired | 2011-11-15 to 2022-11-15 | 2.5.29.32.0 | 0 | - | clean |
| 474 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G3 | yes | current | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.31, 1.3.6.1.4.1.4146.1.40.30 | 1 | Time Stamping, OCSP Signing, 1.2.840.113583.1.1.5 | current errors: 1 |
| 475 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4 | yes | current | 2018-04-18 to 2034-12-10 | 2.5.29.32.0 | - | - | current errors: 1 |
| 476 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL on HV | yes | revoked, expired | 2019-01-16 to 2024-01-16 | 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95 | 0 | OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 477 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL on HV | yes | revoked, expired | 2017-04-19 to 2022-04-19 | 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 478 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45 | yes | current | 2020-07-28 to 2037-07-28 | 2.5.29.32.0 | - | TLS Web Client Authentication | clean |
| 479 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | - | TLS Web Client Authentication | clean |
| 480 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3 | yes | expired | 2015-08-19 to 2017-08-19 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 481 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3 | yes | expired | 2015-07-09 to 2017-07-09 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 482 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3 | yes | expired | 2015-04-30 to 2017-04-30 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 483 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3 | yes | revoked, expired | 2015-04-30 to 2025-04-30 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 484 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3 | yes | expired | 2016-10-14 to 2025-08-19 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 485 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3 | yes | expired | 2015-08-19 to 2025-08-19 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 486 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3 | yes | revoked, expired | 2015-07-09 to 2025-07-09 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 487 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root E45 | yes | current | 2020-07-28 to 2037-07-28 | 2.5.29.32.0 | - | Code Signing | clean |
| 488 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | - | Code Signing | clean |
| 489 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45 | yes | current | 2020-09-16 to 2034-12-10 | 2.5.29.32.0 | - | Code Signing | clean |
| 490 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - G2 | yes | expired | 2011-04-13 to 2026-04-13 | 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | clean |
| 491 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - G3 | yes | expired | 2016-03-16 to 2024-03-16 | 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | historical errors: 1 |
| 492 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - SHA256 - G2 | yes | current | 2011-08-02 to 2028-08-02 | 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | clean |
| 493 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - SHA256 - G3 | yes | expired | 2016-06-15 to 2024-06-15 | 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | historical errors: 1 |
| 494 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2021 | yes | current | 2023-06-28 to 2027-01-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 495 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2021 | yes | current | 2020-01-20 to 2027-01-20 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 496 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2024 | yes | current | 2024-05-15 to 2031-05-15 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 497 | countryName=BE, organizationalUnitName=DocumentSign, organizationName=GlobalSign nv-sa, commonName=GlobalSign DocumentSign CA | yes | revoked, expired | 2009-03-18 to 2017-01-27 | 1.3.6.1.4.1.4146.1.40 | 0 | - | clean |
| 498 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign DocumentSign CA - SHA256 - G2 | yes | revoked, expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 499 | countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA | yes | expired | 2007-05-04 to 2017-05-04 | 1.3.6.1.4.1.4146.1.10 | 0 | Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 500 | countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA | yes | expired | 2007-05-04 to 2017-05-04 | 1.3.6.1.4.1.4146.1.10 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 501 | countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA | yes | expired | 2007-05-04 to 2017-05-04 | 1.3.6.1.4.1.4146.1.10 | 0 | - | clean |
| 502 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 503 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 504 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto | clean |
| 505 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2 | yes | expired | 2016-10-14 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 506 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2 | yes | expired | 2014-02-20 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 507 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 508 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G3 | yes | expired | 2015-09-04 to 2025-09-04 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 509 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Root CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | - | Time Stamping, 1.2.840.113583.1.1.5 | clean |
| 510 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Trusted CA 2026 | yes | current | 2026-06-24 to 2041-06-23 | 1.3.6.1.4.1.4146.1.40.30 | - | 1.2.840.113583.1.1.5 | clean |
| 511 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E46 AATL TimeStamping Root CA 2021 | yes | current | 2021-05-19 to 2038-05-18 | 1.3.6.1.4.1.4146.1.31 | 0 | Time Stamping | clean |
| 512 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E46 AATL TimeStamping Trusted CA 2026 | yes | current | 2026-06-24 to 2044-06-23 | 1.3.6.1.4.1.4146.1.31 | 0 | Time Stamping | clean |
| 513 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign EC Administration CA2 | yes | revoked, expired | 2012-11-13 to 2023-11-13 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 514 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC CloudSSL CA - SHA384 - G3 | yes | current | 2017-06-21 to 2027-06-21 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 515 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC EV SSL CA 2018 | yes | current | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 516 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC EV SSL CA 2019 | yes | revoked | 2019-04-10 to 2029-04-10 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 517 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC HV S/MIME CA 1 | yes | revoked | 2017-08-23 to 2027-08-23 | 1.3.6.1.4.1.4146.1.40.10 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 518 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC OV SSL CA 2018 | yes | current | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 519 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC384 EV SSL CA - G3 | yes | revoked, expired | 2015-04-30 to 2025-04-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 520 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC384 SSL CA - G3 | yes | revoked, expired | 2015-04-30 to 2025-04-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 521 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G2 | yes | revoked, expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 522 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G3 | yes | current | 2016-09-21 to 2026-09-21 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 523 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2 | yes | current | 2011-08-02 to 2028-08-02 | 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | clean |
| 524 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3 | yes | expired | 2016-06-15 to 2024-06-15 | 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95 | 0 | Code Signing, OCSP Signing | historical errors: 1 |
| 525 | organizationalUnitName=Extended Validation SHA256 CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation SHA256 CA | yes | revoked, expired | 2009-11-18 to 2019-03-18 | 2.5.29.32.0 | 0 | - | clean |
| 526 | organizationalUnitName=Extended Validation SHA256 CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation SHA256 CA | yes | revoked, expired | 2009-11-18 to 2019-03-18 | 2.5.29.32.0 | 0 | - | clean |
| 527 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 AATL CA 2026 | yes | current | 2026-07-22 to 2041-06-23 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | not_available |
| 528 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Client Authentication CA 2023 | yes | current | 2023-02-22 to 2033-02-22 | 1.3.6.1.4.1.4146.10.2.2 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login | clean |
| 529 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Client Authentication CA 2024 | yes | current | 2024-06-19 to 2034-06-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 530 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 531 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | current | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 532 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | current | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 533 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified Authentication CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2030-09-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 534 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified QSCD Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2030-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 535 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2030-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 536 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 DV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | current errors: 1 |
| 537 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 EV QWAC CA 2020 | yes | revoked | 2020-07-28 to 2029-07-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 538 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 EV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 539 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 OV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 540 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E46 UK EV QWAC CA 2020 | yes | revoked | 2020-09-16 to 2029-09-16 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 541 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E5 EV QWAC CA 2021 | yes | revoked | 2021-03-24 to 2030-03-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 542 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E5 UK EV QWAC CA 2021 | yes | revoked | 2021-03-24 to 2030-03-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 543 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R1 OV TLS CA 2025 | yes | current | 2025-02-19 to 2028-01-28 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 544 | countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign GCC R3 AlphaSSL CA 2022 | yes | revoked | 2022-09-21 to 2027-09-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 545 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 DV TLS CA 2020 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 546 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 EV QWAC CA 2020 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 547 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 EV TLS CA 2025 | yes | current | 2025-07-16 to 2027-07-16 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 548 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 OV TLS CA 2024 | yes | current | 2024-09-18 to 2029-03-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 549 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 PersonalSign 1 CA 2020 | yes | current | 2020-09-16 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 550 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 PersonalSign 2 CA 2020 | yes | current | 2020-09-16 to 2028-09-16 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange | clean |
| 551 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R3 UK EV QWAC CA 2020 | yes | revoked | 2020-09-16 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 552 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R42 Verified Mark CA 2023 | yes | current | 2023-11-15 to 2038-11-15 | 2.5.29.32.0 | 0 | Brand Indicator for Message Identification | clean |
| 553 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2020 | yes | current | 2020-09-16 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 554 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2026 | yes | current | 2026-01-21 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 555 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2026 2H | yes | current | 2026-07-22 to 2041-06-23 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | not_available |
| 556 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Client Authentication CA 2024 | yes | current | 2024-06-19 to 2034-06-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 557 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 CodeSigning CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 558 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 CodeSigning CA 2020 | yes | current | 2024-06-19 to 2038-07-28 | 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.10.4.2 | 0 | Code Signing | clean |
| 559 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 EV CodeSigning CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3 | 0 | Code Signing | clean |
| 560 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 EV CodeSigning CA 2020 | yes | current | 2024-06-19 to 2038-07-28 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 561 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2020 | yes | expired | 2020-10-21 to 2025-10-21 | 1.3.6.1.4.1.4146.1.40.60 | 0 | TLS Web Client Authentication | clean |
| 562 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2022 | yes | current | 2022-05-18 to 2029-05-18 | 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60 | 0 | TLS Web Client Authentication | clean |
| 563 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2026 | yes | current | 2026-04-22 to 2036-04-22 | 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60 | 0 | TLS Web Client Authentication | clean |
| 564 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 565 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 566 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified QSCD Signing CA 2024, organizationIdentifier=NTRBE-0459134256 | yes | current | 2024-02-21 to 2030-02-21 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 567 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 568 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Signing CA 2024, organizationIdentifier=NTRBE-0459134256 | yes | current | 2024-02-21 to 2030-02-21 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 569 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 SMIME CA 2025 | yes | current | 2025-02-19 to 2030-02-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 570 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified Authentication CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2026-09-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 571 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified QSCD Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2026-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 572 | countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified Signing CA 2020, organizationIdentifier=NTRGB-04705639 | yes | revoked | 2020-09-16 to 2026-09-16 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 573 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 AlphaSSL CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 574 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 DV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 575 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 EV QWAC CA 2025, organizationIdentifier=NTRBE-0459134256 | yes | current | 2025-03-19 to 2031-03-19 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 576 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 EV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 577 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 OV TLS CA 2025 | yes | current | 2025-09-17 to 2029-06-23 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 578 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AATL CA 2020 | yes | current | 2020-09-16 to 2030-09-16 | 1.3.6.1.4.1.4146.1.40.30 | 0 | 1.2.840.113583.1.1.5 | clean |
| 579 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AlphaSSL CA 2023 | yes | expired | 2023-07-19 to 2026-07-19 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 580 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AlphaSSL CA 2025 | yes | current | 2025-05-21 to 2027-05-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 581 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 Authentication CA 2026 | yes | current | 2026-03-31 to 2031-03-31 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 582 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2023 | yes | expired | 2023-07-19 to 2026-07-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 583 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2025 | yes | current | 2025-08-20 to 2026-09-30 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 584 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2025 V2 | yes | current | 2025-10-15 to 2027-10-15 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 585 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 SMIME CA 2023 | yes | current | 2023-04-19 to 2029-04-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 586 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 SMIME CA 2024 | yes | current | 2024-06-19 to 2034-12-10 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6 | clean |
| 587 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV ECC DV SSL CA 2018 | yes | revoked | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 588 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV RSA DV SSL CA 2018 | yes | revoked | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 589 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV S/MIME CA 1 | yes | revoked, expired | 2016-06-15 to 2021-06-15 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 590 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Issuing CA for AATL Partners 2019 | yes | revoked | 2019-07-16 to 2029-04-30 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 591 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=ObjectSign CA, commonName=GlobalSign ObjectSign CA | yes | revoked, expired | 2004-01-22 to 2017-01-27 | 1.3.6.1.4.1.4146.1.50 | 0 | - | clean |
| 592 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=ObjectSign CA, commonName=GlobalSign ObjectSign CA | yes | expired | 2004-01-22 to 2022-01-27 | 1.3.6.1.4.1.4146.1.50 | 0 | - | clean |
| 593 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Offline R45 Timestamping CA 2025 | yes | current | 2025-07-16 to 2041-07-16 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 594 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validated CA - SHA256 - G4 | yes | current | 2018-02-13 to 2028-02-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 595 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validated ECC CA - SHA256 - G4 | yes | current | 2018-02-13 to 2028-02-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 596 | organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA | yes | expired | 2007-04-11 to 2017-04-11 | 1.3.6.1.4.1.4146.1.20 | 0 | - | clean |
| 597 | organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA | yes | expired | 2007-04-11 to 2017-04-11 | 1.3.6.1.4.1.4146.1.20 | 0 | Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 598 | organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA | yes | expired | 2007-03-19 to 2017-04-11 | 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 599 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 600 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto | clean |
| 601 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 602 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2 | yes | expired | 2014-02-20 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 603 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2 | yes | expired | 2016-10-14 to 2024-02-20 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 604 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 605 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G3 | yes | expired | 2015-09-04 to 2025-09-04 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 606 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Partners Timestamping CA - SHA384 - G4 | yes | current | 2018-08-15 to 2034-12-10 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 607 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Partners TSA CA for AATL | yes | current | 2018-08-15 to 2034-12-10 | 2.5.29.32.0 | 0 | - | clean |
| 608 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G2 | yes | expired | 2011-04-13 to 2019-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 609 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G3 | yes | revoked, expired | 2020-01-22 to 2024-03-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User | historical errors: 1 |
| 610 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G3 | yes | revoked, expired | 2016-03-16 to 2024-03-16 | 2.5.29.32.0 | 0 | - | historical errors: 2 |
| 611 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2019-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 612 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - SHA256 - G3 | yes | revoked, expired | 2016-06-15 to 2024-06-15 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 613 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G2 | yes | expired | 2011-04-13 to 2019-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 614 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G2 | yes | expired | 2011-04-13 to 2019-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 615 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G3 | yes | revoked, expired | 2016-03-16 to 2024-03-16 | 2.5.29.32.0 | 0 | - | historical errors: 2 |
| 616 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G3 | yes | revoked, expired | 2020-01-22 to 2024-03-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User | historical errors: 1 |
| 617 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2019-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 618 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2019-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 619 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G3 | yes | revoked, expired | 2016-06-15 to 2024-06-15 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange | historical errors: 1 |
| 620 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G4 | yes | revoked | 2020-05-20 to 2028-05-20 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange | historical errors: 1 |
| 621 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 ECC CA SHA 384 - G4 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange | historical errors: 1 |
| 622 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 RSA CA SHA 384 - G4 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange | historical errors: 1 |
| 623 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G2 | yes | expired | 2011-04-13 to 2019-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 624 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G3 | yes | revoked, expired | 2016-03-16 to 2024-03-16 | 2.5.29.32.0 | 0 | - | historical errors: 2 |
| 625 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G3 | yes | revoked, expired | 2020-01-22 to 2024-03-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User | historical errors: 1 |
| 626 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - SHA256 - G2 | yes | expired | 2011-08-02 to 2019-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 627 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - SHA256 - G3 | yes | revoked, expired | 2016-06-15 to 2024-06-15 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 628 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 1 CA, commonName=GlobalSign PersonalSign Class 1 CA | yes | revoked, expired | 2004-01-22 to 2017-01-27 | 1.3.6.1.4.1.4146.1.40 | 0 | - | clean |
| 629 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 2 CA, commonName=GlobalSign PersonalSign Class 2 CA | yes | revoked, expired | 2004-01-22 to 2017-01-27 | 1.3.6.1.4.1.4146.1.40 | 0 | - | clean |
| 630 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 3 CA, commonName=GlobalSign PersonalSign Class 3 CA | yes | revoked, expired | 2004-01-22 to 2017-01-27 | 1.3.6.1.4.1.4146.1.40 | 0 | - | clean |
| 631 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - G2 | yes | revoked | 2011-04-13 to 2028-01-28 | 2.5.29.32.0 | 1 | - | clean |
| 632 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - G2 | yes | revoked | 2011-04-13 to 2028-01-28 | 2.5.29.32.0 | 1 | - | clean |
| 633 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2 | yes | revoked | 2011-08-02 to 2029-03-29 | 2.5.29.32.0 | 1 | - | clean |
| 634 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2 | yes | revoked | 2020-01-22 to 2029-03-18 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 635 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2 | yes | revoked | 2011-08-02 to 2029-03-29 | 2.5.29.32.0 | 1 | - | clean |
| 636 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 1 CA, commonName=GlobalSign Primary Class 1 CA | yes | expired | 1999-01-27 to 2017-01-27 | - | - | - | clean |
| 637 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 2 CA, commonName=GlobalSign Primary Class 2 CA | yes | expired | 1999-01-28 to 2017-01-27 | - | - | - | clean |
| 638 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 3 CA, commonName=GlobalSign Primary Class 3 CA | yes | expired | 1999-01-28 to 2017-01-27 | - | - | - | clean |
| 639 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA | yes | revoked, expired | 1999-01-28 to 2022-01-27 | - | - | - | clean |
| 640 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA | yes | expired | 1999-01-28 to 2017-01-27 | - | - | - | clean |
| 641 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-05-20 to 2026-05-20 | 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 642 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Authentication ECC CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-05-20 to 2030-05-20 | 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 643 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 1 | yes | revoked | 2018-06-06 to 2028-06-06 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 644 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 2 | yes | revoked | 2018-06-06 to 2028-06-06 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 645 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 3 | yes | revoked | 2018-06-06 to 2028-06-06 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35 | 0 | OCSP Signing, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 646 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-05-20 to 2026-05-20 | 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 647 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified QSCD Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-05-20 to 2030-05-20 | 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 648 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-05-20 to 2026-05-20 | 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 649 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Remote Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-05-20 to 2030-05-20 | 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 650 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-05-20 to 2026-05-20 | 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 651 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-05-20 to 2030-05-20 | 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 652 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Time Stamping CA 2019 | yes | current | 2019-05-15 to 2034-12-10 | 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95 | 0 | Time Stamping, OCSP Signing | current errors: 1 |
| 653 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked, expired | 2020-05-20 to 2026-05-20 | 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95 | 0 | Time Stamping, OCSP Signing | historical errors: 1 |
| 654 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Timestamping ECC CA 2020, organizationIdentifier=NTRBE-0459134256 | yes | revoked | 2020-05-20 to 2035-05-20 | 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95 | 0 | Time Stamping, OCSP Signing | historical errors: 1 |
| 655 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 2.5.29.32.0 | - | Time Stamping, 1.2.840.113583.1.1.5 | clean |
| 656 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL TimeStamping Root CA 2021 | yes | current | 2021-05-19 to 2038-05-18 | 1.3.6.1.4.1.4146.1.31 | 0 | Time Stamping | clean |
| 657 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL TimeStamping Trusted CA 2026 | yes | current | 2026-06-24 to 2044-06-23 | 1.3.6.1.4.1.4146.1.31 | 0 | Time Stamping | clean |
| 658 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Trusted CA 2026 | yes | current | 2026-06-24 to 2041-06-23 | 1.3.6.1.4.1.4146.1.40.30 | - | 1.2.840.113583.1.1.5 | clean |
| 659 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R6 Admin CA - SHA256 - G3 | yes | revoked, expired | 2016-09-21 to 2021-09-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 660 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R6 RSA EV SSL CA 2019 | yes | revoked | 2019-05-15 to 2029-05-15 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 661 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46 | yes | current | 2019-11-20 to 2038-01-19 | 2.5.29.32.0 | - | - | current errors: 1 |
| 662 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46 | yes | current | 2019-11-20 to 2028-01-28 | 2.5.29.32.0 | - | - | current errors: 1 |
| 663 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46 | yes | current | 2019-11-20 to 2029-03-18 | 2.5.29.32.0 | - | - | current errors: 1 |
| 664 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46 | yes | current | 2019-11-20 to 2029-03-18 | 2.5.29.32.0 | - | - | current errors: 1 |
| 665 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46 | yes | current | 2019-11-20 to 2034-12-10 | 2.5.29.32.0 | - | - | current errors: 1 |
| 666 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46 | yes | current | 2019-11-20 to 2028-01-28 | 2.5.29.32.0 | - | - | current errors: 1 |
| 667 | commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE | yes | revoked | 2003-12-16 to 2028-01-28 | - | - | - | clean |
| 668 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA DV SSL CA 2018 | yes | revoked | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 669 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA EV QWAC CA 2019 | yes | revoked | 2019-05-15 to 2028-05-15 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 670 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA EV SSL CA 2019 | yes | revoked | 2019-04-10 to 2029-04-10 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 671 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA OV SSL CA 2018 | yes | current | 2018-11-21 to 2028-11-21 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 672 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root E45 | yes | current | 2020-07-28 to 2037-07-28 | 2.5.29.32.0 | - | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 673 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45 | yes | current | 2020-07-28 to 2029-03-18 | 2.5.29.32.0 | - | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 674 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign SMIME CA 2018 | yes | revoked | 2018-06-20 to 2028-06-20 | 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 675 | organizationalUnitName=Timestamping CA, organizationName=GlobalSign, commonName=GlobalSign Timestamping CA | yes | current | 2009-03-18 to 2028-01-28 | 1.3.6.1.4.1.4146.1.30 | 0 | - | clean |
| 676 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - G2 | yes | current | 2011-04-13 to 2028-01-28 | 2.5.29.32.0 | 0 | - | clean |
| 677 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - G3 | yes | current | 2020-01-22 to 2028-01-28 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30 | 0 | Time Stamping, OCSP Signing | current errors: 1 |
| 678 | organizationalUnitName=Timestamping CA, organizationName=GlobalSign, commonName=GlobalSign Timestamping CA - R3 | yes | current | 2010-04-14 to 2029-03-10 | 1.3.6.1.4.1.4146.1.30 | 0 | - | clean |
| 679 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA256 - G2 | yes | current | 2011-08-02 to 2029-03-29 | 2.5.29.32.0 | 0 | - | clean |
| 680 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA256 - G3 | yes | current | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30 | 0 | Time Stamping, OCSP Signing | current errors: 1 |
| 681 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA384 - G4 | yes | current | 2018-06-20 to 2034-12-10 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 682 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46 | yes | current | 2021-11-17 to 2031-11-17 | 2.5.29.32.0 | - | Time Stamping | clean |
| 683 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45 | yes | current | 2020-12-09 to 2034-12-10 | 2.5.29.32.0 | - | Time Stamping | clean |
| 684 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root E41 | yes | current | 2026-05-20 to 2041-03-31 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2 | - | TLS Web Server Authentication | current errors: 2 |
| 685 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root R41 | yes | current | 2026-05-20 to 2041-03-31 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2 | - | TLS Web Server Authentication | current errors: 1 |
| 686 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TSA CA for AATL | yes | current | 2018-04-18 to 2029-05-18 | 2.5.29.32.0 | 0 | - | clean |
| 687 | countryName=US, organizationName=Google Inc, stateOrProvinceName=California, commonName=Google S/MIME Authority | yes | revoked, expired | 2015-05-20 to 2025-05-20 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection | clean |
| 688 | organizationName=Gracenote Inc, commonName=Gracenote Root CA | yes | revoked, expired | 2010-04-14 to 2020-04-14 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4 | 2 | - | clean |
| 689 | organizationName=Gracenote Inc, commonName=Gracenote Root CA | yes | revoked, expired | 2010-04-21 to 2020-04-21 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.1.1, 1.3.6.1.4.1.35077.509.1.2, 1.3.6.1.4.1.35077.509.1.3, 1.3.6.1.4.1.35077.509.1.4 | 2 | - | clean |
| 690 | organizationName=Gracenote Inc, commonName=Gracenote Root CA | yes | expired | 2010-04-14 to 2020-04-14 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4 | 3 | - | clean |
| 691 | countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG Atlas R45 SMIME CA 2025 | yes | current | 2025-03-19 to 2035-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 692 | countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 693 | countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 694 | countryName=DE, stateOrProvinceName=Bayern, localityName=Mindelheim, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG SMIME CA | yes | revoked, expired | 2018-10-17 to 2023-10-17 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 695 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1 | yes | current | 2020-06-19 to 2028-01-28 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3.2, 1.3.6.1.4.1.11129.2.5.3.3 | - | - | clean |
| 696 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4 | yes | current | 2023-11-15 to 2028-01-28 | 2.23.140.1.2.1 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 697 | countryName=US, organizationName=The HERTZ Corporation, commonName=HERTZ GCC R45 SMIME CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 698 | countryName=US, stateOrProvinceName=Florida, organizationName=The HERTZ Corporation, commonName=HERTZ SHA256 CA - G2 | yes | revoked, expired | 2018-04-18 to 2023-04-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 699 | countryName=HK, stateOrProvinceName=Hong Kong, localityName=Hong Kong, organizationName=Hongkong Post, commonName=Hongkong Post Root CA 3 | yes | current | 2022-11-16 to 2029-03-18 | 2.23.140.1.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.1 | - | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 700 | countryName=GB, organizationName=Hyperion Services Ltd., commonName=Hyperion GCC R3 SMIME CA 2020 | yes | revoked | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 701 | countryName=GB, stateOrProvinceName=London, localityName=London, organizationName=Hyperion Services Ltd., commonName=Hyperion SMIME CA 2018 | yes | revoked, expired | 2018-08-27 to 2023-08-27 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 702 | countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=ICPEdu | yes | expired | 2020-07-05 to 2021-03-04 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 703 | countryName=BR, stateOrProvinceName=Rio de Janeiro, localityName=Rio de Janeiro, organizationalUnitName=Gerencia de Servicos (GSer), organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=ICPEdu | yes | expired | 2014-03-04 to 2021-03-04 | 2.5.29.32.0 | 0 | - | clean |
| 704 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=IHI-EC International Corporation, commonName=IHI E and C International | yes | expired | 2017-12-06 to 2018-04-06 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 705 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=IHI-EC International Corporation, commonName=IHI-EC International Corporation | yes | expired | 2018-01-17 to 2019-07-17 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 706 | countryName=US, organizationName=IHI E&C International Corporation, commonName=IHI-EC International Corporation | yes | expired | 2019-10-22 to 2020-07-31 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 707 | countryName=US, organizationName=InComm Agent Solutions Inc, commonName=InComm Agent Solutions Inc Atlas Issuing CA 2020 | yes | current | 2020-12-09 to 2030-12-09 | 1.3.6.1.4.1.4146.1.40.60 | 0 | TLS Web Client Authentication | clean |
| 708 | countryName=US, stateOrProvinceName=Florida, organizationName=InComm Agent Solutions Inc, commonName=InComm Agent Solutions Inc Root Certificate Authority | yes | expired | 2017-08-23 to 2021-08-23 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.41209.509.1.1 | 1 | TLS Web Client Authentication | historical errors: 1 |
| 709 | countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority | yes | expired | 2019-08-21 to 2020-08-01 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 710 | countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority | yes | revoked, expired | 2019-05-15 to 2021-05-15 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 711 | countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority | yes | expired | 2019-06-12 to 2019-09-01 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 712 | countryName=BE, organizationName=Belgian Mobile ID, commonName=itsme Sign Biometric CA 2025, organizationIdentifier=NTRBE-0541659084 | yes | current | 2025-09-17 to 2035-09-17 | 2.5.29.32.0 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | clean |
| 713 | countryName=BE, organizationName=Belgian Mobile ID, commonName=itsme Sign Non-Biometric CA 2025, organizationIdentifier=NTRBE-0541659084 | yes | current | 2025-09-17 to 2035-09-17 | 2.5.29.32.0 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | clean |
| 714 | countryName=JP, organizationName=GMO GlobalSign K.K., commonName=JCAN GCC R6 Public CA1 - G5 2024 | yes | current | 2024-06-19 to 2034-12-10 | 1.3.6.1.4.1.4146.1.40.20 | 0 | TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36 | clean |
| 715 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0, commonName=JCAN Public CA0 | yes | revoked, expired | 2010-10-21 to 2020-11-21 | 1.2.392.200063.30.5300 | 0 | - | clean |
| 716 | countryName=JP, organizationName=JIPDEC, commonName=JCAN Public CA0 - G2 | yes | revoked, expired | 2011-04-13 to 2021-05-13 | 1.2.392.200063.30.5300 | 0 | - | clean |
| 717 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0 - G3, commonName=JCAN Public CA0 - G3 | yes | revoked, expired | 2011-10-19 to 2022-11-19 | 2.5.29.32.0 | 0 | - | clean |
| 718 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0 - G3, commonName=JCAN Public CA0 - G3 | yes | revoked, expired | 2011-11-15 to 2022-12-15 | 2.5.29.32.0 | 0 | - | clean |
| 719 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1, commonName=JCAN Public CA1 | yes | revoked, expired | 2010-10-21 to 2020-11-21 | 1.2.392.200063.30.5300 | 0 | - | clean |
| 720 | countryName=JP, organizationName=JIPDEC, commonName=JCAN Public CA1 - G2 | yes | revoked, expired | 2011-04-13 to 2021-05-13 | 1.2.392.200063.30.5300 | 0 | - | clean |
| 721 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G3, commonName=JCAN Public CA1 - G3 | yes | revoked, expired | 2011-10-19 to 2022-11-19 | 2.5.29.32.0 | 0 | - | clean |
| 722 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G4, commonName=JCAN Public CA1 - G4 | yes | unknown | 2017-02-22 to 2027-02-22 | 1.3.6.1.4.1.4146.1.40.20 | 0 | E-mail Protection, TLS Web Client Authentication, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14 | current errors: 1 |
| 723 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G4, commonName=JCAN Public CA1 - G4 | yes | current | 2020-07-05 to 2027-02-22 | 1.3.6.1.4.1.4146.1.40.20 | 0 | E-mail Protection, TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14 | clean |
| 724 | countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0 | yes | revoked | 2010-10-21 to 2028-01-28 | - | 1 | - | clean |
| 725 | emailAddress=jotca@jotankers.com, countryName=NO, stateOrProvinceName=Hordaland, localityName=Bergen, organizationName=Jo Tankers, commonName=Jo Tankers CA | yes | revoked, expired | 2008-12-17 to 2018-12-17 | 1.3.6.1.4.1.4146.1.60 | 1 | - | historical errors: 1 |
| 726 | countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 DV TLS CA 2024 | yes | current | 2024-03-20 to 2027-03-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 727 | countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 EV TLS CA 2024 | yes | current | 2024-03-20 to 2027-03-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 728 | countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 OV TLS CA 2024 | yes | current | 2024-03-20 to 2027-03-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 729 | countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest GCC R3 SMIME CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 730 | countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest GCC R3 SMIME CA 2020 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 731 | countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest SMIME CA 2020 | yes | revoked | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 732 | countryName=US, stateOrProvinceName=Louisiana, localityName=Shreveport, organizationalUnitName=IT Security and Policy Group, organizationName=LSU Health System, commonName=LSU Health System CA | yes | revoked, expired | 2012-10-11 to 2017-10-11 | 1.3.6.1.4.1.4146.1.60 | 1 | TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | historical errors: 3 |
| 733 | commonName=Mobile Armor Enterprise CA | yes | revoked, expired | 2008-03-18 to 2018-03-18 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 734 | countryName=MY, organizationName=MSC Trustgate.com Sdn. Bhd., organizationalUnitName=MyTrust Gateway, commonName=MSC Trustgate.com RSA AATL CA 2019 | yes | revoked, expired | 2019-01-16 to 2024-01-16 | 1.3.6.1.4.1.4146.1.40.30.2, 1.3.6.1.4.1.49530.1.1.2.3 | 0 | E-mail Protection, OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |
| 735 | countryName=US, organizationName=GMO GlobalSign Inc., commonName=NAESB GCC R45 Client Authentication CA 2020 | yes | expired | 2020-07-28 to 2026-07-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 736 | countryName=US, organizationName=GMO GlobalSign, Inc., commonName=NAESB GCC R45 Client Authentication CA 2024 | yes | current | 2024-04-17 to 2030-04-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 737 | countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA256 - G2 | yes | expired | 2012-11-13 to 2018-11-12 | 2.5.29.32.0 | 0 | - | clean |
| 738 | countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA256 - G2 | yes | expired | 2012-11-13 to 2018-11-12 | 2.5.29.32.0 | 0 | - | clean |
| 739 | countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G3 | yes | revoked, expired | 2016-05-18 to 2022-05-18 | 2.5.29.32.0 | 0 | - | clean |
| 740 | countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G3 | yes | revoked, expired | 2020-01-22 to 2022-05-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 741 | countryName=US, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G4 | yes | revoked, expired | 2020-01-22 to 2026-01-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5 | historical errors: 1 |
| 742 | emailAddress=its-mensa@nau.edu, stateOrProvinceName=Arizona, organizationalUnitName=Information Technology Services, organizationName=Northern Arizona University, localityName=Flagstaff, countryName=US, commonName=NAU Offline Intermediate CA | yes | revoked, expired | 2009-11-25 to 2019-11-25 | 1.3.6.1.4.1.4146.1.60 | 2 | - | historical errors: 1 |
| 743 | emailAddress=its-mensa@nau.edu, stateOrProvinceName=Arizona, organizationalUnitName=Information Technology Services, organizationName=Northern Arizona University, localityName=Flagstaff, countryName=US, commonName=NAU Offline Intermediate CA | yes | revoked, expired | 2009-12-16 to 2019-12-16 | 1.3.6.1.4.1.4146.1.60 | 2 | - | historical errors: 1 |
| 744 | countryName=US, stateOrProvinceName=NC, organizationName=Department of Revenue, commonName=NCDOR SHA256 CA - G2 | yes | revoked, expired | 2017-06-21 to 2022-06-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 745 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=Noble Energy, Inc., commonName=Noble Energy SHA256 CA - G2 | yes | revoked, expired | 2014-05-28 to 2020-06-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 746 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=Noble Energy, Inc., commonName=Noble Energy SHA256 CA - G2 | yes | expired | 2015-01-22 to 2020-06-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 747 | countryName=AU, organizationName=Department of Education and Training, organizationalUnitName=ITD, commonName=NSW-DET-INT-CA1 | yes | revoked, expired | 2009-11-18 to 2019-11-18 | 1.3.6.1.4.1.4146.1.60 | 2 | - | clean |
| 748 | countryName=AT, organizationName=Osterreichischer Rundfunk, commonName=Osterreichischer Rundfunk Atlas R45 SMIME CA 2026 | yes | current | 2026-01-21 to 2036-01-21 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 749 | countryName=MY, stateOrProvinceName=Selangor, localityName=Cyberjaya, organizationalUnitName=457608-K, organizationName=Pos Digicert Sdn Bhd, commonName=Pos Digicert Issuing CA | yes | revoked, expired | 2017-12-06 to 2022-12-06 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40.30.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 750 | countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies Atlas R46 OV TLS CA 2026 | yes | current | 2026-02-11 to 2031-02-11 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 751 | countryName=NL, stateOrProvinceName=Noord-Brabant, localityName=Son, organizationalUnitName=IT Services, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. Client Issuing CA | yes | revoked, expired | 2017-06-21 to 2022-06-21 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 752 | countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. OV SSL Issuing CA | yes | expired | 2020-07-05 to 2022-06-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 753 | countryName=NL, stateOrProvinceName=Noord-Brabant, localityName=Son, organizationalUnitName=IT Services, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. OV SSL Issuing CA | yes | expired | 2017-06-21 to 2022-06-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 754 | countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies GCC R3 OV TLS CA 2022 | yes | expired | 2022-04-20 to 2025-04-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 755 | countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies GCC R6 OV TLS CA 2024 | yes | current | 2024-09-18 to 2029-09-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 756 | countryName=MX, organizationName=QUALITAS COMPAÑIA DE SEGUROS S.A. DE C.V., localityName=CUAJIMALPA, stateOrProvinceName=CIUDAD DE MEXICO, streetAddress=JOSE MARIA CASTORENA No. 426, SAN JOSE DE LOS CEDROS, postalCode=05200, commonName=Quálitas Compañía de Seguros S.A. de C.V. | yes | revoked | 2019-08-21 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | historical errors: 1 |
| 757 | countryName=MX, organizationName=Quálitas Compañía de Seguros S.A. de C.V., commonName=Quálitas Compañía de Seguros S.A. de C.V. GCC R3 CA 2020 | yes | current | 2020-08-19 to 2029-03-18 | 1.3.6.1.4.1.4146.1.40 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 758 | countryName=SE, organizationName=Riksgälden, commonName=Riksgälden Insättningsgarantin GCC R45 SMIME CA 2025 | yes | current | 2025-12-10 to 2035-12-10 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 759 | countryName=SE, organizationName=Riksgälden, commonName=Riksgälden Insättningsgarantin GCC R6 SMIME CA 2023 | yes | current | 2023-08-16 to 2033-08-16 | 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 1.3.6.1.4.1.4146.10.3.1 | 0 | E-mail Protection | clean |
| 760 | countryName=SE, stateOrProvinceName=Vastra Gotalands Lan, localityName=Goteborg, organizationalUnitName=IT, organizationName=RISE Research Institutes of Sweden AB, commonName=RISE Signing CA | yes | expired | 2019-06-19 to 2020-08-01 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 761 | countryName=SE, stateOrProvinceName=Vastra Gotalands Lan, localityName=Goteborg, organizationalUnitName=IT, organizationName=RISE Research Institutes of Sweden AB, commonName=RISE Signing CA | yes | expired | 2018-01-17 to 2019-07-17 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 762 | countryName=BR, organizationName=REDE NACIONAL DE ENSINO E PESQUISA - RNP, commonName=RNP ICPEdu AR46 OV TLS CA 2025 | yes | current | 2025-12-10 to 2030-12-10 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication | clean |
| 763 | countryName=BR, organizationName=REDE NACIONAL DE ENSINO E PESQUISA - RNP, commonName=RNP ICPEdu GR46 OV TLS CA 2025 | yes | current | 2025-11-19 to 2030-11-19 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20 | 0 | TLS Web Server Authentication | clean |
| 764 | countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=RNP ICPEdu OV SSL CA 2019 | yes | expired | 2020-07-05 to 2026-05-15 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 765 | countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, organizationalUnitName=Gerencia de Servicos (GSer), localityName=Rio de Janeiro, stateOrProvinceName=Rio de Janeiro, commonName=RNP ICPEdu OV SSL CA 2019 | yes | expired | 2019-05-15 to 2026-05-15 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 766 | countryName=US, organizationName=Real Time Technologies, Inc., commonName=RT2 Atlas Client Authentication ICA 2022 | yes | current | 2022-11-16 to 2032-11-16 | 1.3.6.1.4.1.4146.10.2.2 | 0 | TLS Web Client Authentication | clean |
| 767 | countryName=US, stateOrProvinceName=NC, organizationName=RTI International, commonName=RTI SHA256 CA - G2 | yes | expired | 2017-03-15 to 2020-06-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 768 | countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020 | yes | current | 2023-06-28 to 2030-12-17 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 769 | countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020 | yes | current | 2024-05-15 to 2030-12-17 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 770 | countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020 | yes | current | 2020-12-17 to 2030-12-17 | 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 771 | countryName=BR, organizationName=Serasa, organizationalUnitName=Serasa Autoridade Certificadora Global, commonName=SerasaACGlobal | yes | revoked, expired | 2008-03-18 to 2018-03-18 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 772 | countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA DV Secure Server CA | yes | expired | 2019-02-20 to 2024-02-20 | 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 773 | countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA EV Secure Server CA | yes | expired | 2019-02-20 to 2024-02-20 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 774 | countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA OV Secure Server CA | yes | expired | 2019-02-20 to 2024-02-20 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 775 | countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., commonName=SHECA OV Secure Server CA | yes | expired | 2020-07-05 to 2024-02-20 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 776 | organizationalUnitName=SignTrust Domain Verification CA, organizationName=SignTrust, commonName=SignTrust Domain Verification CA | yes | revoked, expired | 2010-06-17 to 2020-06-17 | 1.3.6.1.4.1.4146.1.10.20 | 0 | - | clean |
| 777 | organizationalUnitName=SignTrust Domain Verification CA - G2, organizationName=SignTrust, commonName=SignTrust Domain Verification CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 778 | organizationalUnitName=SignTrust Domain Verification CA - SHA256 - G2, organizationName=SignTrust, commonName=SignTrust Domain Verification CA - SHA256 - G2 | yes | revoked, expired | 2011-08-02 to 2022-08-02 | 2.5.29.32.0 | 0 | - | clean |
| 779 | countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - DV | yes | expired | 2016-02-24 to 2026-02-24 | 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 780 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - DV | yes | expired | 2020-07-05 to 2026-02-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 781 | countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - EV | yes | expired | 2016-02-24 to 2026-02-24 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 782 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - EV | yes | expired | 2020-07-05 to 2026-02-24 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 783 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - OV | yes | expired | 2020-07-05 to 2026-02-24 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 784 | countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - OV | yes | expired | 2016-02-24 to 2026-02-24 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 785 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 DV TLS CA 2025 | yes | current | 2025-12-10 to 2030-12-10 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication | clean |
| 786 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 EV TLS CA 2025 | yes | current | 2025-12-10 to 2030-12-10 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication | clean |
| 787 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 OV TLS CA 2025 | yes | current | 2025-12-10 to 2030-12-10 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication | clean |
| 788 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 DV TLS CA 2024 | yes | current | 2024-11-20 to 2029-11-20 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 789 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 EV TLS CA 2024 | yes | current | 2024-11-20 to 2029-11-20 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 790 | countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 OV TLS CA 2024 | yes | current | 2024-11-20 to 2029-11-20 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 791 | countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA | yes | expired | 2011-09-27 to 2021-09-27 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 792 | countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA | yes | revoked, expired | 2011-11-15 to 2016-11-15 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.1204.509.2.2, 1.3.6.1.4.1.1204.509.2.3, 1.3.6.1.4.1.1204.509.2.4 | 1 | - | clean |
| 793 | countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA | yes | revoked, expired | 2011-09-29 to 2021-09-29 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 794 | countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems Atlas R45 SMIME CA 2025 | yes | current | 2025-04-16 to 2035-04-16 | 2.5.29.32.0 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 795 | countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems GCC R45 SMIME CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 796 | countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems GCC R45 SMIME CA 2020 | yes | current | 2023-06-28 to 2030-07-28 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 797 | countryName=US, stateOrProvinceName=KS, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems SHA256 CA - G2 | yes | revoked, expired | 2017-09-20 to 2022-09-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 798 | countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC E5 OV TLS CA 2024 | yes | current | 2024-09-18 to 2027-09-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 799 | countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 DV TLS CA 2024 | yes | current | 2024-09-18 to 2027-09-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 800 | countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 EV TLS CA 2024 | yes | current | 2024-09-18 to 2027-09-18 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 801 | countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 OV TLS CA 2024 | yes | current | 2024-09-18 to 2027-09-18 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 802 | countryName=GB, organizationName=State Oil Ltd, commonName=State Oil Atlas R45 SMIME CA 2022 | yes | expired | 2022-06-15 to 2025-06-15 | 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 803 | countryName=GB, organizationName=State Oil Ltd, commonName=State Oil Atlas R45 SMIME CA 2022 | yes | expired | 2023-06-28 to 2025-06-15 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 804 | countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022 | yes | current | 2022-04-20 to 2029-03-18 | 1.3.6.1.4.1.4146.10.3.2 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 805 | countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022 | yes | current | 2024-05-15 to 2029-03-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 806 | countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022 | yes | current | 2023-06-28 to 2029-03-18 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 807 | countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R45 SMIME CA 2025 | yes | current | 2025-10-15 to 2035-10-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5 | clean |
| 808 | countryName=US, stateOrProvinceName=OH, localityName=Oxford, organizationName=Miami University, organizationalUnitName=IT Services, commonName=tarquin | yes | revoked, expired | 2008-09-24 to 2018-09-24 | 1.3.6.1.4.1.4146.1.60 | 2 | - | clean |
| 809 | countryName=DE, organizationName=TK Elevator GmbH, commonName=TK Elevator Atlas R6 DV CA 2021 | yes | current | 2021-08-18 to 2031-08-18 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 810 | countryName=IE, localityName=Dublin, organizationName=Touchtech Payments Limited, commonName=Touchtech Intermediate CA | yes | revoked, expired | 2016-09-21 to 2023-09-21 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40 | 1 | - | historical errors: 1 |
| 811 | countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA | yes | expired | 2018-01-17 to 2019-07-17 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 812 | countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA | yes | expired | 2019-07-16 to 2019-09-01 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 813 | countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA | yes | expired | 2017-09-20 to 2020-09-20 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 814 | countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA | yes | expired | 2019-08-21 to 2019-12-31 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 815 | countryName=SG, organizationName=Trafigura PTE Ltd, commonName=Trafigura PTE Ltd Atlas R45 SMIME CA 2020 | yes | current | 2020-07-28 to 2030-07-28 | 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6 | clean |
| 816 | countryName=SG, organizationName=Trafigura PTE Ltd, commonName=Trafigura PTE Ltd S/MIME ICA 2020 | yes | revoked | 2020-01-22 to 2029-03-18 | 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40 | 0 | E-mail Protection, OCSP Signing | historical errors: 1 |
| 817 | countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2 | yes | revoked | 2012-04-25 to 2027-04-25 | 2.5.29.32.0 | - | - | clean |
| 818 | countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2 | yes | revoked | 2012-04-25 to 2027-04-25 | 2.5.29.32.0 | - | - | clean |
| 819 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root nonTLS CA SHA256 G3 | yes | current | 2020-07-05 to 2027-04-25 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14 | clean |
| 820 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3 | yes | current | 2020-07-05 to 2027-04-25 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 821 | countryName=NL, commonName=TUI CA for CoSign, organizationName=TUI Nederland N.V. | yes | expired | 2015-12-15 to 2018-12-15 | 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100, 1.3.6.1.4.1.17277.1.1 | 0 | E-mail Protection, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12 | clean |
| 822 | commonName=Ubizen CA, countryName=BE, organizationName=Ubizen nv | yes | expired | 2004-08-06 to 2022-08-06 | - | - | - | clean |
| 823 | countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID AlphaSSL, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital AlphaSSL CA 2018 | yes | expired | 2018-09-19 to 2023-09-19 | 1.3.6.1.4.1.4146.1.10.10, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 824 | countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital AlphaSSL CA 2018 | yes | expired | 2020-07-05 to 2023-09-19 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 825 | countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL DV CA 2018 | yes | expired | 2020-07-05 to 2023-09-19 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 826 | countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL DV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL DV CA 2018 | yes | expired | 2018-09-19 to 2023-09-19 | 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 827 | countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL EV CA 2018 | yes | expired | 2020-07-05 to 2023-09-19 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 828 | countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL EV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL EV CA 2018 | yes | expired | 2018-09-19 to 2023-09-19 | 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 829 | countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL OV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL OV CA 2018 | yes | expired | 2018-09-19 to 2023-09-19 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 830 | countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL OV CA 2018 | yes | expired | 2020-07-05 to 2023-09-19 | 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 831 | countryName=US, stateOrProvinceName=Virginia, localityName=Blacksburg, organizationalUnitName=Global Qualified Server CA, organizationName=Virginia Polytechnic Institute and State University, commonName=Virginia Tech Global Qualified Server CA | yes | revoked, expired | 2012-12-13 to 2017-12-13 | 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Client Authentication, TLS Web Server Authentication, OCSP Signing | historical errors: 3 |
| 832 | countryName=US, stateOrProvinceName=Virginia, localityName=Blacksburg, organizationalUnitName=Global Qualified Server CA, organizationName=Virginia Polytechnic Institute and State University, commonName=Virginia Tech Global Qualified Server CA | yes | revoked, expired | 2017-12-06 to 2022-12-06 | 1.3.6.1.4.1.4146.1.60 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 2 |
| 833 | countryName=US, organizationName=Virginia Tech, organizationalUnitName=Global Root CA, commonName=Virginia Tech Global Root CA | yes | revoked, expired | 2010-11-18 to 2020-11-18 | 1.3.6.1.4.1.4146.1.60 | 1 | - | clean |
| 834 | countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 DV CA 2021 | yes | revoked | 2021-04-21 to 2031-04-21 | 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 835 | countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 EV CA 2021 | yes | revoked | 2021-04-21 to 2031-04-21 | 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 836 | countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 OV CA 2021 | yes | revoked | 2021-04-21 to 2031-04-21 | 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 837 | countryName=GB, organizationName=Volkswagen Financial Services (UK) Limited, commonName=VWFS CA for AATL | yes | revoked, expired | 2017-04-19 to 2022-04-19 | 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95 | 0 | OCSP Signing, 1.3.6.1.4.1.311.10.3.12 | historical errors: 1 |

## Certificate Details

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 45E6BB038333C3856548E6FF4551
- SHA-256: 2CABEAFE37D06CA22ABA7391C0033D25982952C453647349763A3AB5AD6CCF69
- SPKI SHA-256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
- Validity: 2014-12-10 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r6.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 10 00:00:00 2014 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2CABEAFE37D06CA22ABA7391C0033D25982952C453647349763A3AB5AD6CCF69
    SPKI SHA256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign

- Subject: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 605949E0262EBB55F90A778A71F94AD86C
- SHA-256: 179FBC148A3DD00FD24EA13458CC43BFA7F59C8182D783A513F6EBEC100C8924
- SPKI SHA-256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
- Validity: 2012-11-13 to 2038-01-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf; https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r5.crl, http://crl.globalsign.com/gs/root-r5.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:59:49:e0:26:2e:bb:55:f9:0a:77:8a:71:f9:4a:d8:6c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 179FBC148A3DD00FD24EA13458CC43BFA7F59C8182D783A513F6EBEC100C8924
    SPKI SHA256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000121585308A2
- SHA-256: CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B
- SPKI SHA-256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
- Validity: 2009-03-18 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r3.crl, http://crl.globalsign.net/root-r3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:21:58:53:08:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 18 10:00:00 2009 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B
    SPKI SHA256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Client Authentication Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 7653FEBAB21DD827E96916A2EB81BE58
- SHA-256: 8B0F0FAA2C00FE0532A8A54E7BC5FD139C1922C4F10F0B16E10FB8BE1A634964
- SPKI SHA-256: FAFA6F52E667AE7D3E17407F49F585CA705CD5597F5850CFFDFA64DA6BB3D0CB
- Validity: 2020-03-18 to 2045-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/clientauthroote45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:ba:b2:1d:d8:27:e9:69:16:a2:eb:81:be:58
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8B0F0FAA2C00FE0532A8A54E7BC5FD139C1922C4F10F0B16E10FB8BE1A634964
    SPKI SHA256: FAFA6F52E667AE7D3E17407F49F585CA705CD5597F5850CFFDFA64DA6BB3D0CB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Client Authentication Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 7653FEB9F5C7DBEA8BA478D43E3D6BF6
- SHA-256: 165C7E810BD37C1D57CE9849ACCD500E5CB01EEA37DC550DB07E598AAD2474A8
- SPKI SHA-256: D389519E335DCCE065FC613B4D1F8839DFFC0A9B7F4299C4C2997C4EEAD32F92
- Validity: 2020-03-18 to 2045-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/clientauthrootr45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:b9:f5:c7:db:ea:8b:a4:78:d4:3e:3d:6b:f6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 165C7E810BD37C1D57CE9849ACCD500E5CB01EEA37DC550DB07E598AAD2474A8
    SPKI SHA256: D389519E335DCCE065FC613B4D1F8839DFFC0A9B7F4299C4C2997C4EEAD32F92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Code Signing Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root E45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root E45
- Serial: 7653FEAE1826436F69F51CC27716F25E
- SHA-256: 26C6C5FD4928FD57A8A4C5724FDD279745869C60C338E262FFE901C31BD1DB2B
- SPKI SHA-256: BFD7325B0D1AA2D54F9E4BE938C72203E4BD73904341B0C1836361C2632122E1
- Validity: 2020-03-18 to 2045-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/codesigningroote45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:ae:18:26:43:6f:69:f5:1c:c2:77:16:f2:5e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root E45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A7:9F:DD:D3:54:CD:DB:F8:6C:BF:26:6C:0E:E4:D7:5B:6F:80:CC:42
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 26C6C5FD4928FD57A8A4C5724FDD279745869C60C338E262FFE901C31BD1DB2B
    SPKI SHA256: BFD7325B0D1AA2D54F9E4BE938C72203E4BD73904341B0C1836361C2632122E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Code Signing Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Serial: 7653FEAC75464893F5E5D74A483A4EF8
- SHA-256: 7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
- SPKI SHA-256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
- Validity: 2020-03-18 to 2045-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/codesigningrootr45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
    SPKI SHA256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Document Signing Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 7653FEB0AF4B7590A21AE4A2D5F276B5
- SHA-256: F86973BDD0514735E10C1190D0345BF89C77E1C4ADBD3F65963B803FD3C9E1FF
- SPKI SHA-256: 69EBFEBFF61E910E15F25EEA71307269239D217092B20FA6DC92A7877764DAA0
- Validity: 2020-03-18 to 2045-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf; https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/docsignroote45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:b0:af:4b:75:90:a2:1a:e4:a2:d5:f2:76:b5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F86973BDD0514735E10C1190D0345BF89C77E1C4ADBD3F65963B803FD3C9E1FF
    SPKI SHA256: 69EBFEBFF61E910E15F25EEA71307269239D217092B20FA6DC92A7877764DAA0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Document Signing Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 7653FEB04CA0D571F214B38E2C7F1741
- SHA-256: 38BE6C7EEB4547D82B9287F243AF32A9DEEB5DC5C9A87A0056F938D91B456A5A
- SPKI SHA-256: 6ED0DBD959E2ECBE832398160826F602EE441E1A96F015579BF3A67292A60D3E
- Validity: 2020-03-18 to 2045-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf; https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/docsignrootr45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:b0:4c:a0:d5:71:f2:14:b3:8e:2c:7f:17:41
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 38BE6C7EEB4547D82B9287F243AF32A9DEEB5DC5C9A87A0056F938D91B456A5A
    SPKI SHA256: 6ED0DBD959E2ECBE832398160826F602EE441E1A96F015579BF3A67292A60D3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Root CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001154B5AC394
- SHA-256: EBD41040E4BB3EC742C9E381D31EF2A41A48B6685C96E7CEF3C1DF6CD4331C99
- SPKI SHA-256: 2BCEE858158CF5465FC9D76F0DFA312FEF25A4DCA8501DA9B46B67D1FBFA1B64
- Validity: 1998-09-01 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root.crl, http://crl.globalsign.com/Root.crl, http://crl.globalsign.net/Root.crl, http://crl.globalsign.net/root.crl, http://secure.globalsign.net/crl/Root.crl, http://secure.globalsign.net/crl/root.crl, http://c.pki.goog/r/gsr1.crl, http://crl.pki.goog/gsr1/gsr1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:15:4b:5a:c3:94
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep  1 12:00:00 1998 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: EBD41040E4BB3EC742C9E381D31EF2A41A48B6685C96E7CEF3C1DF6CD4331C99
    SPKI SHA256: 2BCEE858158CF5465FC9D76F0DFA312FEF25A4DCA8501DA9B46B67D1FBFA1B64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 11D2BBBA336ED4BCE62468C50D841D98E843
- SHA-256: CBB9C44D84B8043E1050EA31A69F514955D7BFD2E2C6B49301019AD61D9F5058
- SPKI SHA-256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
- Validity: 2019-03-20 to 2046-03-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/roote46.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d2:bb:ba:33:6e:d4:bc:e6:24:68:c5:0d:84:1d:98:e8:43
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Mar 20 00:00:00 2019 GMT
            Not After : Mar 20 00:00:00 2046 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CBB9C44D84B8043E1050EA31A69F514955D7BFD2E2C6B49301019AD61D9F5058
    SPKI SHA256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Root R46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 11D2BBB9D723189E405F0A9D2DD0DF2567D1
- SHA-256: 4FA3126D8D3A11D1C4855A4F807CBAD6CF919D3A5A88B03BEA2C6372D93C40C9
- SPKI SHA-256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
- Validity: 2019-03-20 to 2046-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rootr46.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d2:bb:b9:d7:23:18:9e:40:5f:0a:9d:2d:d0:df:25:67:d1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 20 00:00:00 2019 GMT
            Not After : Mar 20 00:00:00 2046 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4FA3126D8D3A11D1C4855A4F807CBAD6CF919D3A5A88B03BEA2C6372D93C40C9
    SPKI SHA256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Secure Mail Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root E45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root E45
- Serial: 7653FEAA271D95465DD6F19EE5B8900A
- SHA-256: 5CBF6FB81FD417EA4128CD6F8172A3C9402094F74AB2ED3A06B4405D04F30B19
- SPKI SHA-256: 35FF6B4F5DA2910F8E7E6D583400ED8C7CE6FC85924E25D74EBD27C31EE7AC0B
- Validity: 2020-03-18 to 2045-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/smimeroote45.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:aa:27:1d:95:46:5d:d6:f1:9e:e5:b8:90:0a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root E45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DF:13:5E:8B:5F:C2:40:02:FD:56:B7:94:4C:B6:1E:D5:A6:B1:14:96
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5CBF6FB81FD417EA4128CD6F8172A3C9402094F74AB2ED3A06B4405D04F30B19
    SPKI SHA256: 35FF6B4F5DA2910F8E7E6D583400ED8C7CE6FC85924E25D74EBD27C31EE7AC0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Secure Mail Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7653FEA84C50AB9F8D32B51D038F57DC
- SHA-256: 319AF0A7729E6F89269C131EA6A3A16FCD86389FDCAB3C47A4A675C161A3F974
- SPKI SHA-256: 321638C3101B3FFC36F280F0963185FC16D313F2A92CABED2BC1FA16FB1CAA31
- Validity: 2020-03-18 to 2045-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/smimerootr45.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:a8:4c:50:ab:9f:8d:32:b5:1d:03:8f:57:dc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 319AF0A7729E6F89269C131EA6A3A16FCD86389FDCAB3C47A4A675C161A3F974
    SPKI SHA256: 321638C3101B3FFC36F280F0963185FC16D313F2A92CABED2BC1FA16FB1CAA31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Timestamping Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Serial: 79299B2BD295FD605C36F487AD9EA29E
- SHA-256: 4774674B94B78F5CCBEF89FDDEBDABBD894A71B55576B8CC5E6876BA3EAB4538
- SPKI SHA-256: AC78E34905350F709804A191F2BD537D886DEDEA03D30CEA65B0854B6758FB2D
- Validity: 2021-03-24 to 2046-03-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf; https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/timestamproote46.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9b:2b:d2:95:fd:60:5c:36:f4:87:ad:9e:a2:9e
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Validity
            Not Before: Mar 24 00:00:00 2021 GMT
            Not After : Mar 24 00:00:00 2046 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 4774674B94B78F5CCBEF89FDDEBDABBD894A71B55576B8CC5E6876BA3EAB4538
    SPKI SHA256: AC78E34905350F709804A191F2BD537D886DEDEA03D30CEA65B0854B6758FB2D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Timestamping Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 7653FEB93DD9E7E92632ACD60ABEAC38
- SHA-256: 2BCBBFD66282C680491C8CD7735FDBBAB7A8079B127BEC60C535976834399AF7
- SPKI SHA-256: 16B0D55042A7D9CEB2F1204AA64C65B3A9046E9ECF1BEF5421F3D2BE1BC5FFAC
- Validity: 2020-03-18 to 2045-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-eIDAS-CPCPS-v1.1.pdf; https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=243d0faf-c8d3-45c9-b78b-2151599c412a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=df74f8bd-4c8b-41c7-b178-9fdee8905f8e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/timestamprootr45.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Mar 18 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2045 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2BCBBFD66282C680491C8CD7735FDBBAB7A8079B127BEC60C535976834399AF7
    SPKI SHA256: 16B0D55042A7D9CEB2F1204AA64C65B3A9046E9ECF1BEF5421F3D2BE1BC5FFAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign TLS Root E41

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root E41
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root E41
- Serial: 8587DF965DE89FFB51FDECDFA865C24D
- SHA-256: 6568BB072D96DE2A8EF8A3E89B6B7EF39A6F8394375DF49E9FF1E56A68EC0342
- SPKI SHA-256: F1F3184513F60E70474E6D77C2B1C3F719B2E457A338E7BFF67A47E1FABADC75
- Validity: 2026-03-31 to 2041-03-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gstlsroote41.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:87:df:96:5d:e8:9f:fb:51:fd:ec:df:a8:65:c2:4d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root E41
        Validity
            Not Before: Mar 31 03:36:24 2026 GMT
            Not After : Mar 31 00:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root E41
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                F1:D9:7F:58:8F:6E:70:70:45:83:59:6F:72:6E:CB:23:39:B5:CF:B9
            X509v3 Authority Key Identifier:
                F1:D9:7F:58:8F:6E:70:70:45:83:59:6F:72:6E:CB:23:39:B5:CF:B9
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6568BB072D96DE2A8EF8A3E89B6B7EF39A6F8394375DF49E9FF1E56A68EC0342
    SPKI SHA256: F1F3184513F60E70474E6D77C2B1C3F719B2E457A338E7BFF67A47E1FABADC75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign TLS Root R41

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root R41
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root R41
- Serial: 8587DF54FBD759A020F4356521233B34
- SHA-256: 5F3E53326BAAE806D7728186D92E9BF392D41252866BFBB9B93B131F82B1C42A
- SPKI SHA-256: AF003DED1DDF527C54F49746170362AB64EF673C30F27F5F62822346808BC241
- Validity: 2026-03-31 to 2041-03-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=04c52423-fae9-4bff-a02e-cb9f608939b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6523d9f3-41f8-481a-becb-3d71f9e85897
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gstlsrootr41.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:87:df:54:fb:d7:59:a0:20:f4:35:65:21:23:3b:34
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root R41
        Validity
            Not Before: Mar 31 03:35:32 2026 GMT
            Not After : Mar 31 00:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root R41
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AD:C9:B7:C7:D1:ED:AC:6C:AA:4D:BE:F1:5E:70:36:73:44:EE:67:3C
            X509v3 Authority Key Identifier:
                AD:C9:B7:C7:D1:ED:AC:6C:AA:4D:BE:F1:5E:70:36:73:44:EE:67:3C
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5F3E53326BAAE806D7728186D92E9BF392D41252866BFBB9B93B131F82B1C42A
    SPKI SHA256: AF003DED1DDF527C54F49746170362AB64EF673C30F27F5F62822346808BC241
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign Verified Mark Root R42

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Verified Mark Root R42
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Verified Mark Root R42
- Serial: 7FE530038198A75F7D17C00F242CABF3
- SHA-256: CD122CB877C6928B9017B0F0B80DBD508196300BBD03CD7356C3BEEF524E7E0B
- SPKI SHA-256: 2BC481CEF67E0F12C3249D449F7D75405E73ECE76A7048E9276CE04F5ABA7533
- Validity: 2023-11-15 to 2042-11-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.globalsign.com/en/repository/GlobalSign-Generic-CPCPS-v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbae26a8-947d-40ab-8879-4b9454874bd7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9a2e997e-6fe0-41ba-aeef-6c3bc5404409, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bd1c24dd-3825-459b-a98f-38192e939fcd
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsverifiedmarkrootr42.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:e5:30:03:81:98:a7:5f:7d:17:c0:0f:24:2c:ab:f3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Verified Mark Root R42
        Validity
            Not Before: Nov 15 03:40:52 2023 GMT
            Not After : Nov 15 00:00:00 2042 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Verified Mark Root R42
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3D:B3:E3:F5:20:AE:B9:D3:AC:9B:14:BC:70:25:EE:0F:0A:7E:95:C9
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CD122CB877C6928B9017B0F0B80DBD508196300BBD03CD7356C3BEEF524E7E0B
    SPKI SHA256: 2BC481CEF67E0F12C3249D449F7D75405E73ECE76A7048E9276CE04F5ABA7533
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### AbbVie AATL ICA 2020

- Subject: countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie AATL ICA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign AATL Partners CA 2019
- Serial: 7653FE5AEEFCBE63014518502026303E
- SHA-256: 154E4834B28D4FB1F90FEE935D0DDE46C45A177FC1425A028C685C32855A85AD
- SPKI SHA-256: 188D8992F9628F77557432E0C912F34C396E137B1000914B61AFDA03DC543347
- Validity: 2020-01-22 to 2029-04-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsaatlpartnersca2019
- CRL DP: http://crl.globalsign.com/gsaatlpartnersca2019.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:5a:ee:fc:be:63:01:45:18:50:20:26:30:3e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign AATL Partners CA 2019
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Apr 30 00:00:00 2029 GMT
        Subject: C = US, O = "AbbVie, Inc.", CN = AbbVie AATL ICA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BA:C7:57:97:7A:32:5D:36:96:D5:D1:94:DF:90:71:DB:70:EF:53:E7
            X509v3 Authority Key Identifier:
                2C:94:2C:D0:D0:8B:6D:7F:D8:52:BD:74:0A:A8:58:D8:65:42:FA:28
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsaatlpartnersca2019
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlpartnersca2019.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlpartnersca2019.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 154E4834B28D4FB1F90FEE935D0DDE46C45A177FC1425A028C685C32855A85AD
    SPKI SHA256: 188D8992F9628F77557432E0C912F34C396E137B1000914B61AFDA03DC543347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsaatlpartnersca2019
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlpartnersca2019.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlpartnersca2019.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AbbVie Atlas R45 AATL CA 2022

- Subject: countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R45 AATL CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 7B9E5E28638AE7AEED5D37FAC2898773
- SHA-256: 6FD7EEFF0B14D389FC8115B4FCDF64EED38F29573F0B3969C71BEB0FE55C3F5B
- SPKI SHA-256: 9AB6AD8482259D221C1F33964E0FC52471B2A6EC728C0B3DA001901C35D68D22
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/abbvieatlasr45aatlca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:5e:28:63:8a:e7:ae:ed:5d:37:fa:c2:89:87:73
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = US, O = "AbbVie, Inc.", CN = AbbVie Atlas R45 AATL CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                29:3C:32:68:42:2B:7B:F0:43:21:35:7E:13:8C:0E:69:CF:BD:24:DE
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6FD7EEFF0B14D389FC8115B4FCDF64EED38F29573F0B3969C71BEB0FE55C3F5B
    SPKI SHA256: 9AB6AD8482259D221C1F33964E0FC52471B2A6EC728C0B3DA001901C35D68D22
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### AbbVie Atlas R45 AATL CA 2025

- Subject: countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R45 AATL CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 82B77B9830688AED124E452DD1D5412B
- SHA-256: 930A6F3BE751355957FC1EE5CBECEB98127C9EA3B03ED520002676D39EB6EA5C
- SPKI SHA-256: DE72659D26B91D4E0060BBCBC33F892549C60EACAF7BB46563DF528B896070EB
- Validity: 2025-01-22 to 2030-01-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/abbvieatlasr45aatlca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:7b:98:30:68:8a:ed:12:4e:45:2d:d1:d5:41:2b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Jan 22 05:22:45 2025 GMT
            Not After : Jan 22 00:00:00 2030 GMT
        Subject: C = US, O = "AbbVie, Inc.", CN = AbbVie Atlas R45 AATL CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DF:E9:16:7F:0A:D3:61:FB:18:E4:55:14:23:10:F8:F6:8E:DF:C4:41
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 930A6F3BE751355957FC1EE5CBECEB98127C9EA3B03ED520002676D39EB6EA5C
    SPKI SHA256: DE72659D26B91D4E0060BBCBC33F892549C60EACAF7BB46563DF528B896070EB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AbbVie Atlas R6 AATL ICA 2020

- Subject: countryName=US, organizationName=AbbVie, Inc., commonName=AbbVie Atlas R6 AATL ICA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 78031A94FED928167CF64D8CFBD0E03F
- SHA-256: 6509F94BCA4DC619F3E732D533ACD3D0F10ABA102A13123B6AF737C8E12DAA21
- SPKI SHA-256: E7B4C815D043A386D6AF4DA8689E3C1037A649EF53F1363F3F3AE398C3707E0D
- Validity: 2020-08-19 to 2030-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/abbvieatlasr6aatlica2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:94:fe:d9:28:16:7c:f6:4d:8c:fb:d0:e0:3f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Aug 19 00:00:00 2030 GMT
        Subject: C = US, O = "AbbVie, Inc.", CN = AbbVie Atlas R6 AATL ICA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C9:F9:E7:31:23:E3:01:A1:A3:68:DC:81:33:0A:34:F8:93:01:69:64
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6509F94BCA4DC619F3E732D533ACD3D0F10ABA102A13123B6AF737C8E12DAA21
    SPKI SHA256: E7B4C815D043A386D6AF4DA8689E3C1037A649EF53F1363F3F3AE398C3707E0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AC Defesa GR3 OV TLS CA 2023

- Subject: countryName=BR, organizationName=Ministerio da Defesa, commonName=AC Defesa GR3 OV TLS CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E2A8906851518E6650243C8B0C98A91
- SHA-256: 23D5EFBFB41CE7B1F30BAB8A8F64AF85EDBB5D7A49C08D616DE4C47CADB03597
- SPKI SHA-256: 24F41FCF8805E2D57DDEC6BE309B00DDCDB9C10C15CB3A94A679ED697E8298FC
- Validity: 2023-02-22 to 2027-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/acdefesagr3ovtlsca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:2a:89:06:85:15:18:e6:65:02:43:c8:b0:c9:8a:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 22 03:17:11 2023 GMT
            Not After : Feb 22 00:00:00 2027 GMT
        Subject: C = BR, O = Ministerio da Defesa, CN = AC Defesa GR3 OV TLS CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                78:B3:B8:16:7C:C0:37:F9:35:A2:E2:73:5B:AD:92:E2:FA:2F:E4:25
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 23D5EFBFB41CE7B1F30BAB8A8F64AF85EDBB5D7A49C08D616DE4C47CADB03597
    SPKI SHA256: 24F41FCF8805E2D57DDEC6BE309B00DDCDB9C10C15CB3A94A679ED697E8298FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### AC Defesa GR46 OV TLS CA 2025

- Subject: countryName=BR, organizationName=Ministerio da Defesa, commonName=AC Defesa GR46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8414C8B95B1DE7FD07BB772B3A56B5E2
- SHA-256: BEE9ED069C7BCD513E02718AEACD127C9F6794749710C3EAAE7A851CF1A8A8A0
- SPKI SHA-256: B7D81517B43E40B7E2BC6EC5DD76280A5D7C73BF9876B1B9ADF30A73BB384108
- Validity: 2025-08-20 to 2029-08-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/acdefesagr46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:14:c8:b9:5b:1d:e7:fd:07:bb:77:2b:3a:56:b5:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Aug 20 03:22:05 2025 GMT
            Not After : Aug 20 00:00:00 2029 GMT
        Subject: C = BR, O = Ministerio da Defesa, CN = AC Defesa GR46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7E:B0:A8:AC:55:19:23:A1:DD:BF:F6:9B:E5:7C:4D:A5:BC:D5:36:2A
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BEE9ED069C7BCD513E02718AEACD127C9F6794749710C3EAAE7A851CF1A8A8A0
    SPKI SHA256: B7D81517B43E40B7E2BC6EC5DD76280A5D7C73BF9876B1B9ADF30A73BB384108
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AC SERPRO AR46 OV TLS CA 2025

- Subject: countryName=BR, organizationName=SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), commonName=AC SERPRO AR46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8471F46D8B7C0A0AC132A5E778727C0B
- SHA-256: F27095D0B40DF765599404011CF8B167DA06260E81DDA727F163EF08221071E4
- SPKI SHA-256: A98B990E39F3AAD82AA71C63A399E0B4025DCB677B4E6118D8C4FEE62CA2A7FE
- Validity: 2025-10-15 to 2030-10-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/acserproar46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:6d:8b:7c:0a:0a:c1:32:a5:e7:78:72:7c:0b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 15 03:10:25 2025 GMT
            Not After : Oct 15 00:00:00 2030 GMT
        Subject: C = BR, O = SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), CN = AC SERPRO AR46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:50:99:51:78:E1:75:4E:C1:FF:67:15:E1:2E:D0:B2:23:D4:3D:86
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F27095D0B40DF765599404011CF8B167DA06260E81DDA727F163EF08221071E4
    SPKI SHA256: A98B990E39F3AAD82AA71C63A399E0B4025DCB677B4E6118D8C4FEE62CA2A7FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Accenture Federal Services External CA

- Subject: countryName=US, stateOrProvinceName=DE, organizationName=Accenture Federal Services LLC, commonName=Accenture Federal Services External CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E528B4C8253760E1FBA142D7
- SHA-256: A9C8E971259A2ED6E65F721E07AA967C72C7CDB47C7BE1288D87BF08D2F3580D
- SPKI SHA-256: 93745BE59A8D624EBFD6912C9C158D344D729FDBDF22527DD19577BEA6FBA045
- Validity: 2017-09-20 to 2022-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b4:c8:25:37:60:e1:fb:a1:42:d7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Sep 20 00:00:00 2017 GMT
            Not After : Sep 20 00:00:00 2022 GMT
        Subject: C = US, ST = DE, O = Accenture Federal Services LLC, CN = Accenture Federal Services External CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                97:94:62:3D:4E:0B:EC:84:F7:F0:1B:A3:8E:87:A6:85:8E:90:A5:87
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A9C8E971259A2ED6E65F721E07AA967C72C7CDB47C7BE1288D87BF08D2F3580D
    SPKI SHA256: 93745BE59A8D624EBFD6912C9C158D344D729FDBDF22527DD19577BEA6FBA045
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Accenture Federal Services GCC R3 Global CA 2020

- Subject: countryName=US, organizationName=Accenture Federal Services LLC, commonName=Accenture Federal Services GCC R3 Global CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9DADDBC40603582F0631A4796B
- SHA-256: 9D61B40ECFE094B415FBF6AEEA1FDB27A1A4C3B6FD9008D768777D6D7FBAAEE9
- SPKI SHA-256: 37BF64F928B5F2197AEF2B0E20196230C46FC68105533B3A37BED7528D939430
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/afsgccr3globalca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9d:ad:db:c4:06:03:58:2f:06:31:a4:79:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = Accenture Federal Services LLC, CN = Accenture Federal Services GCC R3 Global CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9A:F0:C5:7D:60:BA:F4:0F:56:82:A2:70:F4:40:5B:CB:B4:F5:3F:AB
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D61B40ECFE094B415FBF6AEEA1FDB27A1A4C3B6FD9008D768777D6D7FBAAEE9
    SPKI SHA256: 37BF64F928B5F2197AEF2B0E20196230C46FC68105533B3A37BED7528D939430
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Alibaba Cloud GCC R3 AlphaSSL CA 2021

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B29CE8C8BAD8FD1D2586D77BBF7F914
- SHA-256: 7AEDE5374ECA9FF34C5727C10DB982222D753157797449B88364F70EEFA0C24C
- SPKI SHA-256: 00BDCD1DB1E4C237749A25F5AF09FED7A448AE39D44E65827487616FCC27E0C5
- Validity: 2021-11-17 to 2024-11-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3alphasslca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:29:ce:8c:8b:ad:8f:d1:d2:58:6d:77:bb:f7:f9:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 17 12:00:00 2021 GMT
            Not After : Nov 17 00:00:00 2024 GMT
        Subject: C = CN, O = "Alibaba Cloud Computing Co., Ltd.", CN = Alibaba Cloud GCC R3 AlphaSSL CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:44:51:2B:22:92:39:80:FF:D1:D4:00:63:79:2B:2A:8D:8A:FF:CF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7AEDE5374ECA9FF34C5727C10DB982222D753157797449B88364F70EEFA0C24C
    SPKI SHA256: 00BDCD1DB1E4C237749A25F5AF09FED7A448AE39D44E65827487616FCC27E0C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Alibaba Cloud GCC R3 AlphaSSL CA 2023

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C31ABD919E716A5344112CDF46A9
- SHA-256: DFC6EE42E6A7B339DF178E566EFB5482AA1A460C586A32D67C9AB053AF2BE657
- SPKI SHA-256: 2B510B0419A5618DD34FAB269C070C2D4CF6703161687BBC556F18C007F9DF65
- Validity: 2023-04-19 to 2026-11-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3alphasslca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c3:1a:bd:91:9e:71:6a:53:44:11:2c:df:46:a9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:54:07 2023 GMT
            Not After : Nov 17 00:00:00 2026 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R3 AlphaSSL CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BE:C8:A2:88:59:BF:F5:E7:EF:8F:58:57:F5:80:84:03:E0:FC:72:2C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DFC6EE42E6A7B339DF178E566EFB5482AA1A460C586A32D67C9AB053AF2BE657
    SPKI SHA256: 2B510B0419A5618DD34FAB269C070C2D4CF6703161687BBC556F18C007F9DF65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Alibaba Cloud GCC R3 AlphaSSL CA 2025

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 AlphaSSL CA 2025
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA8676F40BD23BDAC9847A93F4B2D6
- SHA-256: 9A3FC708F61E036AF88CECB2E8DA79A3B21F092CFC172C31DD5A93DCFA15248F
- SPKI SHA-256: 404FE453E33656129731670504B84034E3B1A9F82D3C08B25514337B99EC0354
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3alphasslca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:76:f4:0b:d2:3b:da:c9:84:7a:93:f4:b2:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:05:54 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R3 AlphaSSL CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B6:A5:E0:20:99:FF:3D:96:39:D8:8E:16:61:CB:55:48:4B:62:7A:67
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9A3FC708F61E036AF88CECB2E8DA79A3B21F092CFC172C31DD5A93DCFA15248F
    SPKI SHA256: 404FE453E33656129731670504B84034E3B1A9F82D3C08B25514337B99EC0354
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Alibaba Cloud GCC R3 DV TLS CA 2021

- Subject: countryName=CN, organizationName=Aliyun Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB334F1853CDF1B296DCF0F3D2B67C
- SHA-256: 0FBBBC699B65EA9B676F1042BE3F093224CB1F769F142579B8CA023AEDD6E706
- SPKI SHA-256: 525778D2D1B15D2B7BE78249BDC75E1CD1DB426D724EEBE5D814C1856F3993E6
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:4f:18:53:cd:f1:b2:96:dc:f0:f3:d2:b6:7c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = CN, O = "Aliyun Computing Co., Ltd.", CN = Alibaba Cloud GCC R3 DV TLS CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B2:A8:52:DA:E1:FC:CB:B6:E4:5E:02:AD:46:E7:81:B7:01:B7:8D:97
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0FBBBC699B65EA9B676F1042BE3F093224CB1F769F142579B8CA023AEDD6E706
    SPKI SHA256: 525778D2D1B15D2B7BE78249BDC75E1CD1DB426D724EEBE5D814C1856F3993E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Alibaba Cloud GCC R3 DV TLS CA 2021

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B29CE9DC77A6671DBE3C787DC0B34A5
- SHA-256: 8F3E5D6858B927D284FDB85A1B15875CD78E63B820C20DDC539CCD84B0C1A6AA
- SPKI SHA-256: 3E0D43B9B72EFBC0321FC65DC876BE6CFEAC0E9A41BFD7EF5ECC80EBA5A015BA
- Validity: 2021-11-17 to 2024-11-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3dvtlsca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:29:ce:9d:c7:7a:66:71:db:e3:c7:87:dc:0b:34:a5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 17 12:00:00 2021 GMT
            Not After : Nov 17 00:00:00 2024 GMT
        Subject: C = CN, O = "Alibaba Cloud Computing Co., Ltd.", CN = Alibaba Cloud GCC R3 DV TLS CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BB:3E:38:51:C5:10:37:74:E7:AD:1D:49:80:CF:C7:C9:DA:6C:B4:7F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F3E5D6858B927D284FDB85A1B15875CD78E63B820C20DDC539CCD84B0C1A6AA
    SPKI SHA256: 3E0D43B9B72EFBC0321FC65DC876BE6CFEAC0E9A41BFD7EF5ECC80EBA5A015BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Alibaba Cloud GCC R3 DV TLS CA 2023

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 DV TLS CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C316D246BAE742F032DDAB7658C9
- SHA-256: 38CBB87231F062A82D7ED2EF73FD4E4B84352EA7DD7F15686DE3A9414B7AE029
- SPKI SHA-256: 0EDD0B253012EF1A573030A76B1C7031F8431E31D6710B630E79BB91563F9E30
- Validity: 2023-04-19 to 2026-11-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3dvtlsca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c3:16:d2:46:ba:e7:42:f0:32:dd:ab:76:58:c9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:54:04 2023 GMT
            Not After : Nov 17 00:00:00 2026 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R3 DV TLS CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2A:B3:32:2A:3D:D7:22:0A:69:BE:DE:BB:AA:DF:A2:9D:C8:27:64:F5
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 38CBB87231F062A82D7ED2EF73FD4E4B84352EA7DD7F15686DE3A9414B7AE029
    SPKI SHA256: 0EDD0B253012EF1A573030A76B1C7031F8431E31D6710B630E79BB91563F9E30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Alibaba Cloud GCC R3 OV TLS CA 2023

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R3 OV TLS CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C312E431739C0EB98D04C7BDF726
- SHA-256: 73360680F0C0DE2C542EB3DAB2B30764D5451606501953C76D51A2F6EBD1C29B
- SPKI SHA-256: 5518DA2D0EC1FB0B6544CC2C682DC1EF31779935FFD4E5701885669538CE4A28
- Validity: 2023-04-19 to 2026-11-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3ovtlsca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c3:12:e4:31:73:9c:0e:b9:8d:04:c7:bd:f7:26
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:54:01 2023 GMT
            Not After : Nov 17 00:00:00 2026 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R3 OV TLS CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:88:F2:A6:25:05:42:53:95:BD:76:6B:4E:8F:48:48:35:4D:A1:FE
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 73360680F0C0DE2C542EB3DAB2B30764D5451606501953C76D51A2F6EBD1C29B
    SPKI SHA256: 5518DA2D0EC1FB0B6544CC2C682DC1EF31779935FFD4E5701885669538CE4A28
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Alibaba Cloud GCC R3 TLS OV CA 2021

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Co., Ltd., commonName=Alibaba Cloud GCC R3 TLS OV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A2984EC6F5CDA07FCB7244AF629C444
- SHA-256: 31A096A1CB918876EE57C85B2349FC9CC2C2CB4FCF9BDD37787CE9DA57AF4790
- SPKI SHA-256: 1DA71A6CC3BA2B8A4CFAC85F0751243021A11F64D2952BD58B31033D4D51BACA
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr3tlsovca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:84:ec:6f:5c:da:07:fc:b7:24:4a:f6:29:c4:44
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = CN, O = "Alibaba Cloud Computing Co., Ltd.", CN = Alibaba Cloud GCC R3 TLS OV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:3E:B8:1C:CB:84:39:B1:8D:B6:47:DF:F8:FE:61:E1:C8:11:D0:BE
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 31A096A1CB918876EE57C85B2349FC9CC2C2CB4FCF9BDD37787CE9DA57AF4790
    SPKI SHA256: 1DA71A6CC3BA2B8A4CFAC85F0751243021A11F64D2952BD58B31033D4D51BACA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Alibaba Cloud GCC R46 AlphaSSL CA 2025

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R46 AlphaSSL CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA867C4326B1052543981843055C0C
- SHA-256: 3B9746CAB4CC932794DE76EA49D9AB6EF598C0F13EDAE18B996C0FF00DA8877B
- SPKI SHA-256: 311AE32BE7B5A5CB01307B856D15AB7FA324472C8E956CBA781B7F31D03B48A9
- Validity: 2025-07-16 to 2030-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr46alphasslca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:7c:43:26:b1:05:25:43:98:18:43:05:5c:0c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:05:58 2025 GMT
            Not After : Jul 16 00:00:00 2030 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R46 AlphaSSL CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CC:C2:56:CB:CC:56:16:AF:CD:F9:DC:67:4D:39:63:5A:87:6F:3C:0C
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B9746CAB4CC932794DE76EA49D9AB6EF598C0F13EDAE18B996C0FF00DA8877B
    SPKI SHA256: 311AE32BE7B5A5CB01307B856D15AB7FA324472C8E956CBA781B7F31D03B48A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Alibaba Cloud GCC R46 DV TLS CA 2025

- Subject: countryName=CN, organizationName=Alibaba Cloud Computing Ltd., commonName=Alibaba Cloud GCC R46 DV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86958F38EB389898437D239543AF
- SHA-256: E9124DEB5D7DEA83A5AA07666F8BADCBE898FCD8699902699B306A0A87683A5C
- SPKI SHA-256: AD18C169B52209B8AD9A7E0C6BFFBC5BA82F2828D163AB11D44D1BBFE0C6D955
- Validity: 2025-07-16 to 2030-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alibabacloudgccr46dvtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:95:8f:38:eb:38:98:98:43:7d:23:95:43:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:06:18 2025 GMT
            Not After : Jul 16 00:00:00 2030 GMT
        Subject: C = CN, O = Alibaba Cloud Computing Ltd., CN = Alibaba Cloud GCC R46 DV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:24:E8:6A:A4:FC:F4:28:F7:C9:1A:B1:E2:5A:D6:00:41:68:22:C0
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E9124DEB5D7DEA83A5AA07666F8BADCBE898FCD8699902699B306A0A87683A5C
    SPKI SHA256: AD18C169B52209B8AD9A7E0C6BFFBC5BA82F2828D163AB11D44D1BBFE0C6D955
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Alpha CA

- Subject: organizationalUnitName=Alpha CA, organizationName=Alpha, commonName=Alpha CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5F365
- SHA-256: 8E7C508A8740073FEB042262BC816F26D6801CC4DE7D3F03CD3A6D62747ECC06
- SPKI SHA-256: 4D33ABF7B142E512692D5CBB519F5FAE2BCE579B8A3709D80AFF0B31E889D4E6
- Validity: 2007-04-11 to 2017-04-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:f3:65
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 11 12:00:00 2007 GMT
            Not After : Apr 11 12:00:00 2017 GMT
        Subject: OU = Alpha CA, O = Alpha, CN = Alpha CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0A:29:FA:AD:AF:4D:FD:FD:5D:7D:76:26:87:AB:AA:5A:AA:74:22:15
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10.10
                  CPS: http://www.alphassl.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8E7C508A8740073FEB042262BC816F26D6801CC4DE7D3F03CD3A6D62747ECC06
    SPKI SHA256: 4D33ABF7B142E512692D5CBB519F5FAE2BCE579B8A3709D80AFF0B31E889D4E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Alpha CA

- Subject: organizationalUnitName=Alpha CA, organizationName=Alpha, commonName=Alpha CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5F171
- SHA-256: 76AD3977211F501E6D6ED674DCFD92F1C89D1498A330767CD8CBBCA81FFA02AB
- SPKI SHA-256: 4D33ABF7B142E512692D5CBB519F5FAE2BCE579B8A3709D80AFF0B31E889D4E6
- Validity: 2007-04-11 to 2017-04-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:f1:71
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 11 12:00:00 2007 GMT
            Not After : Apr 11 12:00:00 2017 GMT
        Subject: OU = Alpha CA, O = Alpha, CN = Alpha CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0A:29:FA:AD:AF:4D:FD:FD:5D:7D:76:26:87:AB:AA:5A:AA:74:22:15
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10.10
                  CPS: http://www.alphassl.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 76AD3977211F501E6D6ED674DCFD92F1C89D1498A330767CD8CBBCA81FFA02AB
    SPKI SHA256: 4D33ABF7B142E512692D5CBB519F5FAE2BCE579B8A3709D80AFF0B31E889D4E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### AlphaSSL CA - G2

- Subject: organizationName=AlphaSSL, commonName=AlphaSSL CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13702
- SHA-256: 1DCA65B86A57336BA5AFB7214A36F7D6EDE698EB4F03387CB3AD6BBD3A93BAB6
- SPKI SHA-256: CB18225862BEF92141F724B0B77337AA99F91CED192C56390FE87E1BFBDC4FF7
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:37:02
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: O = AlphaSSL, CN = AlphaSSL CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                14:EA:19:55:F0:0E:0D:32:C6:1F:74:33:B7:8E:66:1A:4C:12:31:1E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.alphassl.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1DCA65B86A57336BA5AFB7214A36F7D6EDE698EB4F03387CB3AD6BBD3A93BAB6
    SPKI SHA256: CB18225862BEF92141F724B0B77337AA99F91CED192C56390FE87E1BFBDC4FF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G2

- Subject: organizationName=AlphaSSL, commonName=AlphaSSL CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C639DC
- SHA-256: 933E4A2D8DB1FF9FF0E508EA7F1637E074F660FE6F365A2233DFC2B52C889D98
- SPKI SHA-256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsalphasha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:39:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: O = AlphaSSL, CN = AlphaSSL CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:CD:D5:3C:08:50:F9:6A:4F:3A:B7:97:DA:56:83:E6:69:D2:68:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.alphassl.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 933E4A2D8DB1FF9FF0E508EA7F1637E074F660FE6F365A2233DFC2B52C889D98
    SPKI SHA256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48CA8179F83E8A42F3F5CDE2B13F
- SHA-256: 8C2410F76B149CA062B420AB611B6BF0A06E6E799A29587E4D4EC16D0537B7EA
- SPKI SHA-256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
- Validity: 2016-10-14 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsalphasha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:ca:81:79:f8:3e:8a:42:f3:f5:cd:e2:b1:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 14 00:00:00 2016 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:CD:D5:3C:08:50:F9:6A:4F:3A:B7:97:DA:56:83:E6:69:D2:68:F7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C2410F76B149CA062B420AB611B6BF0A06E6E799A29587E4D4EC16D0537B7EA
    SPKI SHA256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001444EF03A38
- SHA-256: 5A817EADA4AD78734EBB2CF674352D97F4352290C40EAF10E764B1EAC075B0E6
- SPKI SHA-256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
- Validity: 2014-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsalphasha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:3a:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:CD:D5:3C:08:50:F9:6A:4F:3A:B7:97:DA:56:83:E6:69:D2:68:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5A817EADA4AD78734EBB2CF674352D97F4352290C40EAF10E764B1EAC075B0E6
    SPKI SHA256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001444EF03631
- SHA-256: EE793643199474ED60EFDC8CCDE4D37445921683593AA751BBF8EE491A391E97
- SPKI SHA-256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
- Validity: 2014-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsalphasha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:36:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:CD:D5:3C:08:50:F9:6A:4F:3A:B7:97:DA:56:83:E6:69:D2:68:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.alphassl.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE793643199474ED60EFDC8CCDE4D37445921683593AA751BBF8EE491A391E97
    SPKI SHA256: 6A631E57A81BF50371D197FB16D275F566BFB7607B2A9085FF59F626CDD4B925
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 4707B1004C728907CD354755F722
- SHA-256: 4C013B8854689CB6626CC087B4D4FCCA45104E2D73BFADF33A6979ED124B7837
- SPKI SHA-256: CA2CADC66C5596A5246A88C1B3088F43701DB4580575E477FA97D18333F38F27
- Validity: 2015-09-04 to 2025-09-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:07:b1:00:4c:72:89:07:cd:35:47:55:f7:22
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep  4 00:00:00 2015 GMT
            Not After : Sep  4 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1E:AB:30:46:2F:C1:9D:4C:97:A9:DD:51:04:9A:BF:FB:8D:0A:C1:7D
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4C013B8854689CB6626CC087B4D4FCCA45104E2D73BFADF33A6979ED124B7837
    SPKI SHA256: CA2CADC66C5596A5246A88C1B3088F43701DB4580575E477FA97D18333F38F27
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### AlphaSSL CA - SHA256 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=AlphaSSL CA - SHA256 - G4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7D4D42A92B431D7E6453E7C19A8D5877
- SHA-256: 7C4E90207B2B7CAEC080426CC469908CB27B925EE3B1C999C22B8568812FDA8C
- SPKI SHA-256: 05BAD5221118BEF04BE858B20BB9F354A2CB0D4DC63D876A1D601F9347AFFFCD
- Validity: 2022-10-12 to 2027-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/alphasslcasha256g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:a9:2b:43:1d:7e:64:53:e7:c1:9a:8d:58:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Oct 12 03:49:43 2022 GMT
            Not After : Oct 12 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4F:CB:AC:A8:C2:EF:AB:DD:83:6F:6B:BF:CE:98:3D:5C:58:25:76:15
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7C4E90207B2B7CAEC080426CC469908CB27B925EE3B1C999C22B8568812FDA8C
    SPKI SHA256: 05BAD5221118BEF04BE858B20BB9F354A2CB0D4DC63D876A1D601F9347AFFFCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r1.crt
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ATT Atlas R3 OV TLS CA 2020

- Subject: countryName=US, organizationName=ATT Services Inc, commonName=ATT Atlas R3 OV TLS CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803183B473ADF265141CAFFF161A371
- SHA-256: DC2728331312E75C4D7B442F3BDDA790CB77A9D6AC854D5BCE18AC43CA59909A
- SPKI SHA-256: EE0B3026469623573699F0947D3DC5A518C879FDA719DC95D3B5286BE1D245FE
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/attatlasr3ovtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:3b:47:3a:df:26:51:41:ca:ff:f1:61:a3:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = ATT Services Inc, CN = ATT Atlas R3 OV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D0:23:68:AC:27:BD:50:29:05:63:4E:14:F2:1C:37:67:E7:86:2A:F0
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC2728331312E75C4D7B442F3BDDA790CB77A9D6AC854D5BCE18AC43CA59909A
    SPKI SHA256: EE0B3026469623573699F0947D3DC5A518C879FDA719DC95D3B5286BE1D245FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ATT Organization Validated CA 2019

- Subject: countryName=US, organizationName=ATT Services Inc, organizationalUnitName=ATT Business Wi-Fi Services, localityName=Austin, stateOrProvinceName=Texas, commonName=ATT Organization Validated CA 2019
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3EECA4A059CCEF82A888148F76D9
- SHA-256: 7AA45D6F5B14DAB1C6844C19C2804E14B5811E6EDE1F02B0AEF065A7B359C68F
- SPKI SHA-256: 60E32F31ED88A2DF76D72C52C9DFBCC0B63E6BC6FFCD8666777D7310D102C851
- Validity: 2019-05-15 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3e:ec:a4:a0:59:cc:ef:82:a8:88:14:8f:76:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = ATT Services Inc, OU = ATT Business Wi-Fi Services, L = Austin, ST = Texas, CN = ATT Organization Validated CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:45:7B:79:04:A8:D3:29:F8:D1:3C:2D:63:19:8D:E9:AC:AB:68:3B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7AA45D6F5B14DAB1C6844C19C2804E14B5811E6EDE1F02B0AEF065A7B359C68F
    SPKI SHA256: 60E32F31ED88A2DF76D72C52C9DFBCC0B63E6BC6FFCD8666777D7310D102C851
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp

### ATT Wi-Fi Services Root Certificate Authority

- Subject: commonName=ATT Wi-Fi Services Root Certificate Authority, organizationalUnitName=ATT Wi-Fi Services, organizationName=ATT Services Inc, countryName=US
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 040000000001331BC2F5B9
- SHA-256: B146C26FB01609FE0A1A95ABC54B8DBC8AE26A9FB67F34C2E751509394B81AC0
- SPKI SHA-256: 20A6AE3B42172410C155C35BF267CF12ADC80941AE8D2C1D1185EA8071D31BDC
- Validity: 2011-10-19 to 2021-10-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4552.509.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:1b:c2:f5:b9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Oct 19 10:00:00 2011 GMT
            Not After : Oct 19 10:00:00 2021 GMT
        Subject: CN = ATT Wi-Fi Services Root Certificate Authority, OU = ATT Wi-Fi Services, O = ATT Services Inc, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                CF:49:03:DF:BB:84:70:40:AD:8D:F5:A2:7B:35:46:05:45:1E:AE:E7
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: GlobalSign Trusted Root Program
                Policy: 1.3.6.1.4.1.4552.509.1.1
                  CPS: http://crl.pki.wayport.net/cps.html
                  User Notice:
                    Explicit Text: Copyright (c) 2011 ATT Wi-Fi Services All Rights Reserved
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B146C26FB01609FE0A1A95ABC54B8DBC8AE26A9FB67F34C2E751509394B81AC0
    SPKI SHA256: 20A6AE3B42172410C155C35BF267CF12ADC80941AE8D2C1D1185EA8071D31BDC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4552.509.1.1
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Banco Votorantim SA GR6 EV TLS CA 2024

- Subject: countryName=BR, organizationName=Banco Votorantim S.A., commonName=Banco Votorantim SA GR6 EV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 824E7535B0CC6AF365AF947DAEF8B4CC
- SHA-256: 055D79B306BAC2201A00C705D27745C7E9CF3D7F4379ACD13D8639D2C4F94DF4
- SPKI SHA-256: 1F3BB29BDB97337901FF8197B1AF0F3ECEA4D288DBCD8A618E20B25C8D4320B7
- Validity: 2024-11-20 to 2029-11-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/bancovotorantimsagr6evtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:4e:75:35:b0:cc:6a:f3:65:af:94:7d:ae:f8:b4:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 02:35:59 2024 GMT
            Not After : Nov 20 00:00:00 2029 GMT
        Subject: C = BR, O = Banco Votorantim S.A., CN = Banco Votorantim SA GR6 EV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:5A:50:08:7C:0E:FB:95:16:40:0E:2C:B7:71:19:11:43:23:DB:3F
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 055D79B306BAC2201A00C705D27745C7E9CF3D7F4379ACD13D8639D2C4F94DF4
    SPKI SHA256: 1F3BB29BDB97337901FF8197B1AF0F3ECEA4D288DBCD8A618E20B25C8D4320B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Beame.io CA 1

- Subject: countryName=IL, stateOrProvinceName=Tel Aviv, localityName=Tel Aviv-Jaffa, organizationName=Beame.io Ltd, commonName=Beame.io CA 1
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 4844DCC1DC5E09855F10929AF263
- SHA-256: 43263913B483EB6F0B020540F8F7BE0A1D7C9CE7652FE0FB4743D7213393551C
- SPKI SHA-256: E5FC49D34DA0E489742D268066D8840BB05E17CCFE73106830B93B96513D59E2
- Validity: 2016-07-20 to 2021-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:44:dc:c1:dc:5e:09:85:5f:10:92:9a:f2:63
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Jul 20 00:00:00 2016 GMT
            Not After : Jul 20 00:00:00 2021 GMT
        Subject: C = IL, ST = Tel Aviv, L = Tel Aviv-Jaffa, O = Beame.io Ltd, CN = Beame.io CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:1F:AD:7D:15:31:0E:D4:96:5A:11:54:27:1E:16:10:E8:B5:39:37
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 43263913B483EB6F0B020540F8F7BE0A1D7C9CE7652FE0FB4743D7213393551C
    SPKI SHA256: E5FC49D34DA0E489742D268066D8840BB05E17CCFE73106830B93B96513D59E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Beame.io CA 1

- Subject: countryName=IL, organizationName=Beame.io Ltd, commonName=Beame.io CA 1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D7A35494268B8AC20C44A7E9639
- SHA-256: 0D36F6A2299E9E268F94ADB49E57E6717D713C3F47B889C40DCDC8CFE940CB80
- SPKI SHA-256: E5FC49D34DA0E489742D268066D8840BB05E17CCFE73106830B93B96513D59E2
- Validity: 2020-07-05 to 2021-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:7a:35:49:42:68:b8:ac:20:c4:4a:7e:96:39
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Jul 20 00:00:00 2021 GMT
        Subject: C = IL, O = Beame.io Ltd, CN = Beame.io CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:1F:AD:7D:15:31:0E:D4:96:5A:11:54:27:1E:16:10:E8:B5:39:37
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0D36F6A2299E9E268F94ADB49E57E6717D713C3F47B889C40DCDC8CFE940CB80
    SPKI SHA256: E5FC49D34DA0E489742D268066D8840BB05E17CCFE73106830B93B96513D59E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Beame.io CA 2

- Subject: countryName=IL, stateOrProvinceName=Tel Aviv, localityName=Tel Aviv-Jaffa, organizationName=Beame.io Ltd, commonName=Beame.io CA 2
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 4844DCD55BD0280E0B6F6A116881
- SHA-256: CF6E6B82C997CB5CC1A55066AF5F60CAAC77594EB106FB4D498BC50ECDEB8A3A
- SPKI SHA-256: F4CB4984F8D8C0E5B4D93702A9A9FEE09FD11CD4F7D9D42B68C224D0F6E0B6CC
- Validity: 2016-08-17 to 2026-08-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:44:dc:d5:5b:d0:28:0e:0b:6f:6a:11:68:81
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Aug 17 00:00:00 2016 GMT
            Not After : Aug 17 00:00:00 2026 GMT
        Subject: C = IL, ST = Tel Aviv, L = Tel Aviv-Jaffa, O = Beame.io Ltd, CN = Beame.io CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8E:DC:CC:D6:65:90:7E:A8:38:5F:E4:DE:03:3D:07:1B:CC:15:F0:85
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF6E6B82C997CB5CC1A55066AF5F60CAAC77594EB106FB4D498BC50ECDEB8A3A
    SPKI SHA256: F4CB4984F8D8C0E5B4D93702A9A9FEE09FD11CD4F7D9D42B68C224D0F6E0B6CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Bechtel Atlas R45 SMIME ICA 2022

- Subject: countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7D877C237A2B8E21B16557FA830F3B18
- SHA-256: 6390D54F26A13B6511B25130EC0580987AFAB843F15A1E16695AA456BD36C043
- SPKI SHA-256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
- Validity: 2022-11-16 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/bechtelatlasr45smimeica2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:87:7c:23:7a:2b:8e:21:b1:65:57:fa:83:0f:3b:18
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Nov 16 03:36:13 2022 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = Bechtel Corporation, CN = Bechtel Atlas R45 SMIME ICA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:A4:31:94:EB:9B:B7:97:9E:EC:05:1C:42:10:81:98:54:7E:EF:C1
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6390D54F26A13B6511B25130EC0580987AFAB843F15A1E16695AA456BD36C043
    SPKI SHA256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Bechtel Atlas R45 SMIME ICA 2022

- Subject: countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC376CC824C35E6830B665321852A3
- SHA-256: CCBED114280CFAA28407DF31913F99CA2F212B52E52CD3E150F8CD448EE459C3
- SPKI SHA-256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
- Validity: 2023-06-28 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/bechtelatlasr45smimeica2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:6c:c8:24:c3:5e:68:30:b6:65:32:18:52:a3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:44 2023 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = Bechtel Corporation, CN = Bechtel Atlas R45 SMIME ICA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:A4:31:94:EB:9B:B7:97:9E:EC:05:1C:42:10:81:98:54:7E:EF:C1
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CCBED114280CFAA28407DF31913F99CA2F212B52E52CD3E150F8CD448EE459C3
    SPKI SHA256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Bechtel Atlas R45 SMIME ICA 2022

- Subject: countryName=US, organizationName=Bechtel Corporation, commonName=Bechtel Atlas R45 SMIME ICA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8114041C556BD3D9A9BD1B4B0CC3F62E
- SHA-256: BE71D33732D4857FF7AE610DFCC5E0A70B93F14C5D7A3418347D82CE975654AE
- SPKI SHA-256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
- Validity: 2024-05-15 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/bechtelatlasr45smimeica2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:1c:55:6b:d3:d9:a9:bd:1b:4b:0c:c3:f6:2e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: May 15 03:23:27 2024 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = Bechtel Corporation, CN = Bechtel Atlas R45 SMIME ICA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:A4:31:94:EB:9B:B7:97:9E:EC:05:1C:42:10:81:98:54:7E:EF:C1
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BE71D33732D4857FF7AE610DFCC5E0A70B93F14C5D7A3418347D82CE975654AE
    SPKI SHA256: D6D7BFA22B043B601DB1039F668940D3F30475CA06345F9F0EA12439A0B09D23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Belgium Root CA2

- Subject: countryName=BE, commonName=Belgium Root CA2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012C5E7F1A88
- SHA-256: 96F0A38A034557D8677D6E6D3B6C57D5ADD2CDBA2C2EA12ADCFFC193DF979AE8
- SPKI SHA-256: F8E5F905BC939911267B83D50814A90323B51E183629DB52D4FC2D5468A5A578
- Validity: 2007-10-04 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.56.9.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://secure.globalsign.net/crl/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2c:5e:7f:1a:88
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Oct  4 10:00:00 2007 GMT
            Not After : Jan 28 10:00:00 2028 GMT
        Subject: C = BE, CN = Belgium Root CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                85:8A:EB:F4:C5:BB:BE:0E:59:03:94:DE:D6:80:01:15:E3:10:9C:39
            X509v3 Certificate Policies:
                Policy: 2.16.56.9.1.1
                  CPS: http://repository.eid.belgium.be
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://secure.globalsign.net/crl/root.crl
            Netscape Cert Type:
                SSL CA, S/MIME CA, Object Signing CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 96F0A38A034557D8677D6E6D3B6C57D5ADD2CDBA2C2EA12ADCFFC193DF979AE8
    SPKI SHA256: F8E5F905BC939911267B83D50814A90323B51E183629DB52D4FC2D5468A5A578
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.56.9.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://secure.globalsign.net/crl/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Booz Allen Hamilton CA 2

- Subject: countryName=US, organizationName=BAH, organizationalUnitName=Components, commonName=Booz Allen Hamilton CA 2
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000011E44878F3F
- SHA-256: 728FB6C57CB257134D3FD9E54B3F79C677867985E9EF112B51BE37238DD5B6E7
- SPKI SHA-256: 44842F153A91501653D95BCD7B035504B7CA4DEDCD1FC65FCD2531EB22F9995E
- Validity: 2008-12-17 to 2018-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:87:8f:3f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec 17 12:00:00 2008 GMT
            Not After : Dec 17 12:00:00 2018 GMT
        Subject: C = US, O = BAH, OU = Components, CN = Booz Allen Hamilton CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                62:63:D4:EE:7C:0B:C4:5D:C6:C0:AE:14:30:5D:FF:1C:9C:E6:48:D4
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 728FB6C57CB257134D3FD9E54B3F79C677867985E9EF112B51BE37238DD5B6E7
    SPKI SHA256: 44842F153A91501653D95BCD7B035504B7CA4DEDCD1FC65FCD2531EB22F9995E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### CareFirst SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=MD, organizationName=CareFirst, Inc., commonName=CareFirst SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E528B0A73400590BB067636B
- SHA-256: CF9B7EF7B437F7E4709A0507E5C5871690021D64F3B8FCE703EC85C85AE8FA29
- SPKI SHA-256: 38E3C692289A17CCFBFFFA6E50AB9097AD1766964C8CC118A1528A5CF4DA37FC
- Validity: 2017-08-23 to 2022-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b0:a7:34:00:59:0b:b0:67:63:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Aug 23 00:00:00 2017 GMT
            Not After : Aug 23 00:00:00 2022 GMT
        Subject: C = US, ST = MD, O = "CareFirst, Inc.", CN = CareFirst SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:1B:17:FB:B5:AD:5D:53:BD:42:2D:D9:23:7A:5E:40:A2:58:89:8B
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF9B7EF7B437F7E4709A0507E5C5871690021D64F3B8FCE703EC85C85AE8FA29
    SPKI SHA256: 38E3C692289A17CCFBFFFA6E50AB9097AD1766964C8CC118A1528A5CF4DA37FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CBMM Atlas R45 SMIME CA 2025

- Subject: countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 831489D33E4F714FA39FDCDDC4BD91E2
- SHA-256: BCCC52A414C3A58B8B2684B608B4CE4AC6B0FC2208EEED85BA0696866EAA3FF4
- SPKI SHA-256: 458E7897562D7776A16FFC8335C5F22960926F51197604A1B6E18FB39DE2186F
- Validity: 2025-03-19 to 2030-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/cbmmatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:89:d3:3e:4f:71:4f:a3:9f:dc:dd:c4:bd:91:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Mar 19 03:31:28 2025 GMT
            Not After : Mar 19 00:00:00 2030 GMT
        Subject: C = BR, O = COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, CN = CBMM Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:E7:15:F7:76:9D:0D:7C:9A:1E:D1:CD:93:DC:EA:92:CF:76:93:7F
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BCCC52A414C3A58B8B2684B608B4CE4AC6B0FC2208EEED85BA0696866EAA3FF4
    SPKI SHA256: 458E7897562D7776A16FFC8335C5F22960926F51197604A1B6E18FB39DE2186F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CBMM GCC R3 SMIME CA 2020

- Subject: countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9E61C8DC597D607991C9E8F895
- SHA-256: F6F9C3FC5636C7E800EB1BDDFD33AAF98495C130DBF48F9BAF4AB7A1F665DFB4
- SPKI SHA-256: BE531D74C57D6EC571F0A3FA15712C6383616E0C573C0D158A59E6D709DA1BAA
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cbmmgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9e:61:c8:dc:59:7d:60:79:91:c9:e8:f8:95
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BR, O = COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, CN = CBMM GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                47:49:FC:9D:7C:DC:3A:E9:2E:18:49:1A:F0:5F:84:01:C6:F8:58:72
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6F9C3FC5636C7E800EB1BDDFD33AAF98495C130DBF48F9BAF4AB7A1F665DFB4
    SPKI SHA256: BE531D74C57D6EC571F0A3FA15712C6383616E0C573C0D158A59E6D709DA1BAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CBMM GCC R3 SMIME CA 2020

- Subject: countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, commonName=CBMM GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC373B48C905C8BB350B460073E107
- SHA-256: F6FAD88040CA2A7301B7ABA5094E9610B344368C2D37A99D0EDC6F0CD534B297
- SPKI SHA-256: BE531D74C57D6EC571F0A3FA15712C6383616E0C573C0D158A59E6D709DA1BAA
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cbmmgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:3b:48:c9:05:c8:bb:35:0b:46:00:73:e1:07
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:31:05 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BR, O = COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, CN = CBMM GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                47:49:FC:9D:7C:DC:3A:E9:2E:18:49:1A:F0:5F:84:01:C6:F8:58:72
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6FAD88040CA2A7301B7ABA5094E9610B344368C2D37A99D0EDC6F0CD534B297
    SPKI SHA256: BE531D74C57D6EC571F0A3FA15712C6383616E0C573C0D158A59E6D709DA1BAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CBMM SMIME CA 2019

- Subject: countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, localityName=ARAXA, stateOrProvinceName=MINAS GERAIS, streetAddress=RUA CORREGO DA MATA S/N, postalCode=38183-903, commonName=CBMM SMIME CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 751E3F5636E8453FD909AD304F54E3FB
- SHA-256: C346D9137E05254C6EEAC99AC2F6748A0C5D3AFC6B7B9B1E00C40ADF4D85655D
- SPKI SHA-256: 260AF2B04397717587C947536EF157A949B277AD2EC557E4890B72C2566FFE71
- Validity: 2019-04-30 to 2028-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:56:36:e8:45:3f:d9:09:ad:30:4f:54:e3:fb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Apr 30 00:00:00 2019 GMT
            Not After : Apr 30 00:00:00 2028 GMT
        Subject: C = BR, O = COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, L = ARAXA, ST = MINAS GERAIS, street = RUA CORREGO DA MATA S/N, postalCode = 38183-903, CN = CBMM SMIME CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                09:28:7B:73:29:9B:88:CE:CB:BE:93:ED:28:A7:42:44:A1:8D:3C:B9
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C346D9137E05254C6EEAC99AC2F6748A0C5D3AFC6B7B9B1E00C40ADF4D85655D
    SPKI SHA256: 260AF2B04397717587C947536EF157A949B277AD2EC557E4890B72C2566FFE71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CBMM SMIME CA 2019

- Subject: countryName=BR, organizationName=COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, localityName=ARAXA, stateOrProvinceName=MINAS GERAIS, streetAddress=RUA CORREGO DA MATA S/N, postalCode=38183-903, commonName=CBMM SMIME CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 11D71C3B599B2024276CF16C048DB8DBB349
- SHA-256: 16CFC331B1FB63ABDBD61BAA806C5EA9F33C98F7E4F185BBC86A9803594174F4
- SPKI SHA-256: 260AF2B04397717587C947536EF157A949B277AD2EC557E4890B72C2566FFE71
- Validity: 2019-04-30 to 2028-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d7:1c:3b:59:9b:20:24:27:6c:f1:6c:04:8d:b8:db:b3:49
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Apr 30 00:00:00 2019 GMT
            Not After : Apr 30 00:00:00 2028 GMT
        Subject: C = BR, O = COMPANHIA BRASILEIRA DE METALURGIA E MINERACAO, L = ARAXA, ST = MINAS GERAIS, street = RUA CORREGO DA MATA S/N, postalCode = 38183-903, CN = CBMM SMIME CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                09:28:7B:73:29:9B:88:CE:CB:BE:93:ED:28:A7:42:44:A1:8D:3C:B9
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 16CFC331B1FB63ABDBD61BAA806C5EA9F33C98F7E4F185BBC86A9803594174F4
    SPKI SHA256: 260AF2B04397717587C947536EF157A949B277AD2EC557E4890B72C2566FFE71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Chenega Root CA

- Subject: countryName=US, organizationName=Chenega Corporation, commonName=Chenega Root CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000012945C3AB1C
- SHA-256: 69023C565C4747F136E8AF1FA67055B7486532B69EEE226AFEDB9155126B17B4
- SPKI SHA-256: 86EBFD465512749E3E89370B6C62BBE9D7CDB6274FD0E0CBAA81097E315FE1E4
- Validity: 2010-06-17 to 2020-06-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35724.509.1.1, 1.3.6.1.4.1.35724.509.1.2, 1.3.6.1.4.1.35724.509.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:29:45:c3:ab:1c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Jun 17 12:00:00 2010 GMT
            Not After : Jun 17 12:00:00 2020 GMT
        Subject: C = US, O = Chenega Corporation, CN = Chenega Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                88:78:58:0C:5C:A9:94:C6:69:06:D3:17:DD:95:70:15:C1:EA:5A:75
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.net/repository/
                Policy: 1.3.6.1.4.1.35724.509.1.1
                  User Notice:
                    Explicit Text: http://www.chenega.com/pki/cps.html
                Policy: 1.3.6.1.4.1.35724.509.1.2
                Policy: 1.3.6.1.4.1.35724.509.1.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 69023C565C4747F136E8AF1FA67055B7486532B69EEE226AFEDB9155126B17B4
    SPKI SHA256: 86EBFD465512749E3E89370B6C62BBE9D7CDB6274FD0E0CBAA81097E315FE1E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35724.509.1.1, 1.3.6.1.4.1.35724.509.1.2, 1.3.6.1.4.1.35724.509.1.3
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Chunghwa Telecom GCC R46 OV TLS CA 2025

- Subject: countryName=TW, organizationName=Chunghwa Telecom Co., Ltd., commonName=Chunghwa Telecom GCC R46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86FCDF893C3A46EA5923AD9502F9
- SHA-256: DA1EE3B14A2E562BEC2AD5E543548E0BB583296E39FADF69A8A13F30F0AC4DC5
- SPKI SHA-256: 9D7DAD1F4E85D3D71CD2CE84789D8AEEC2C04E9A738940EE0F8E8E6B05B9FCE3
- Validity: 2025-07-16 to 2030-07-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/chunghwatelecomgccr46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:fc:df:89:3c:3a:46:ea:59:23:ad:95:02:f9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:07:40 2025 GMT
            Not After : Jul 16 00:00:00 2030 GMT
        Subject: C = TW, O = "Chunghwa Telecom Co., Ltd.", CN = Chunghwa Telecom GCC R46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:31:6B:CB:DF:63:94:AC:40:A4:8F:70:88:0C:78:8E:25:D9:4D:BF
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DA1EE3B14A2E562BEC2AD5E543548E0BB583296E39FADF69A8A13F30F0AC4DC5
    SPKI SHA256: 9D7DAD1F4E85D3D71CD2CE84789D8AEEC2C04E9A738940EE0F8E8E6B05B9FCE3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Clayco Atlas R45 SMIME CA 2022

- Subject: countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC3763A405DEB27FEB9A50CE1FB343
- SHA-256: CDA61B2C3AEDD28FEEC05F6D0AE4102A1BD001CB4ED7F590F4A0B4B1EADD9B02
- SPKI SHA-256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
- Validity: 2023-06-28 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/claycoatlasr45smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:63:a4:05:de:b2:7f:eb:9a:50:ce:1f:b3:43
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:37 2023 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = "Clayco, Inc.", CN = Clayco Atlas R45 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:EE:D3:B4:9E:78:E5:D1:ED:D3:A7:65:3F:C9:18:47:FD:18:FD:57
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CDA61B2C3AEDD28FEEC05F6D0AE4102A1BD001CB4ED7F590F4A0B4B1EADD9B02
    SPKI SHA256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Clayco Atlas R45 SMIME CA 2022

- Subject: countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7D877BE6DE8F21823864AD47B6AE7246
- SHA-256: 5B92AF30724309D82A1DEDDFB0975A336A7C7A45DDCAB6E0D24A48EBC49575B9
- SPKI SHA-256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
- Validity: 2022-11-16 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/claycoatlasr45smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:87:7b:e6:de:8f:21:82:38:64:ad:47:b6:ae:72:46
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Nov 16 03:35:25 2022 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = "Clayco, Inc.", CN = Clayco Atlas R45 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:EE:D3:B4:9E:78:E5:D1:ED:D3:A7:65:3F:C9:18:47:FD:18:FD:57
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5B92AF30724309D82A1DEDDFB0975A336A7C7A45DDCAB6E0D24A48EBC49575B9
    SPKI SHA256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Clayco Atlas R45 SMIME CA 2022

- Subject: countryName=US, organizationName=Clayco, Inc., commonName=Clayco Atlas R45 SMIME CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 811404440F435F1D7FDE1E92AA11365C
- SHA-256: F3794E0BB2EA5D4CD0E9C7818FFB66891A9F6FAE5AE8B9059E68E673FA03ADA7
- SPKI SHA-256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
- Validity: 2024-05-15 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/claycoatlasr45smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:44:0f:43:5f:1d:7f:de:1e:92:aa:11:36:5c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: May 15 03:23:59 2024 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = "Clayco, Inc.", CN = Clayco Atlas R45 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:EE:D3:B4:9E:78:E5:D1:ED:D3:A7:65:3F:C9:18:47:FD:18:FD:57
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F3794E0BB2EA5D4CD0E9C7818FFB66891A9F6FAE5AE8B9059E68E673FA03ADA7
    SPKI SHA256: 17C170765783797F00CFFFA97B0A3F0702E8EF320ECADE5C2C5E793E06211B5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cloudflare ECC DV CA

- Subject: countryName=US, stateOrProvinceName=CA, localityName=San Francisco, organizationName=Cloudflare, Inc., commonName=Cloudflare ECC DV CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D89F70D7650AF23B835674
- SHA-256: 0F4517487FD0A8BA3194A6122450A7B32C987FFF16F2D4AF54E6EDB6FED68E08
- SPKI SHA-256: 4C8B5D7F099E21E1AC22FB008C708CED5B0BC91AAA763E56D840A9545E12F692
- Validity: 2018-02-13 to 2023-02-13
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:70:d7:65:0a:f2:3b:83:56:74
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2023 GMT
        Subject: C = US, ST = CA, L = San Francisco, O = "Cloudflare, Inc.", CN = Cloudflare ECC DV CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                10:07:DC:33:E4:09:D7:34:2C:89:07:49:3C:F4:38:87:5B:33:8C:4F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F4517487FD0A8BA3194A6122450A7B32C987FFF16F2D4AF54E6EDB6FED68E08
    SPKI SHA256: 4C8B5D7F099E21E1AC22FB008C708CED5B0BC91AAA763E56D840A9545E12F692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Cloudflare RSA DV CA

- Subject: countryName=US, stateOrProvinceName=CA, localityName=San Francisco, organizationName=Cloudflare, Inc., commonName=Cloudflare RSA DV CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D89F6606F537E76F4D8BF7
- SHA-256: D439F88E8F2F80A306F910DCDE548D71BBFD99A85FC7034EFB610E3749550932
- SPKI SHA-256: 1F2AAA38669E1FDCE0EC1835DB0B6E40D3540790D9C1F8F67345BFA16A832C8D
- Validity: 2018-02-13 to 2023-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:66:06:f5:37:e7:6f:4d:8b:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2023 GMT
        Subject: C = US, ST = CA, L = San Francisco, O = "Cloudflare, Inc.", CN = Cloudflare RSA DV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                68:C5:E7:7B:FC:DB:54:30:84:D2:EE:CC:22:08:D2:A8:15:FB:FB:28
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D439F88E8F2F80A306F910DCDE548D71BBFD99A85FC7034EFB610E3749550932
    SPKI SHA256: 1F2AAA38669E1FDCE0EC1835DB0B6E40D3540790D9C1F8F67345BFA16A832C8D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### COMESA GCC R45 SMIME CA 2021

- Subject: countryName=ZM, organizationName=Common Market for Eastern and Southern Africa Secretariat, commonName=COMESA GCC R45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC3732F04C692518F6854D16CD854D
- SHA-256: 6A9BE0304446B285BC45477B0C9495281E4F99FF4E4441DCF8AE16C0E49F3379
- SPKI SHA-256: 56686E0FA9396B9E2270DEE500ADEE8CF16D5B818879E84562479B70881126A9
- Validity: 2023-06-28 to 2028-07-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/comesagccr45smimeca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:32:f0:4c:69:25:18:f6:85:4d:16:cd:85:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:30:58 2023 GMT
            Not After : Jul 14 00:00:00 2028 GMT
        Subject: C = ZM, O = Common Market for Eastern and Southern Africa Secretariat, CN = COMESA GCC R45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:A9:35:82:5D:95:2D:7D:9E:CE:0A:DF:5D:8F:7B:08:B5:B8:46:51
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6A9BE0304446B285BC45477B0C9495281E4F99FF4E4441DCF8AE16C0E49F3379
    SPKI SHA256: 56686E0FA9396B9E2270DEE500ADEE8CF16D5B818879E84562479B70881126A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### COMESA GCC R45 SMIME CA 2021

- Subject: countryName=ZM, organizationName=Common Market for Eastern and Southern Africa Secretariat, commonName=COMESA GCC R45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7A581B582F66CD212D72ABF43FD8B36E
- SHA-256: C50DECEFBC246CB07F4FEB282A7633337721F787F8EB68D897F05284FF94FA8A
- SPKI SHA-256: 56686E0FA9396B9E2270DEE500ADEE8CF16D5B818879E84562479B70881126A9
- Validity: 2021-07-14 to 2028-07-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/comesagccr45smimeca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:58:1b:58:2f:66:cd:21:2d:72:ab:f4:3f:d8:b3:6e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jul 14 12:00:00 2021 GMT
            Not After : Jul 14 00:00:00 2028 GMT
        Subject: C = ZM, O = Common Market for Eastern and Southern Africa Secretariat, CN = COMESA GCC R45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:A9:35:82:5D:95:2D:7D:9E:CE:0A:DF:5D:8F:7B:08:B5:B8:46:51
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C50DECEFBC246CB07F4FEB282A7633337721F787F8EB68D897F05284FF94FA8A
    SPKI SHA256: 56686E0FA9396B9E2270DEE500ADEE8CF16D5B818879E84562479B70881126A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CoSign by ARX CA

- Subject: countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45EA23A443FD0BBBC35D6F021D08
- SHA-256: 3025E05437517139872114F9C81B340E79F4D8F33D5DC069B01F433492C7EBED
- SPKI SHA-256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
- Validity: 2014-12-10 to 2017-12-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:ea:23:a4:43:fd:0b:bb:c3:5d:6f:02:1d:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec 10 00:00:00 2014 GMT
            Not After : Dec 10 00:00:00 2017 GMT
        Subject: C = US, ST = California, O = ARX Inc., CN = CoSign by ARX CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:3A:8D:3E:14:C5:AD:CD:17:0E:5A:6E:85:6E:8D:1A:FE:95:55:D0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.arx.com
                  email:arx.com
                  DNS:arx.com
                  DirName:C = US, ST = California, O = ARX Inc.
                  DirName:C = US, O = ARX Inc.
                  DirName:O = ARX Inc.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100

    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3025E05437517139872114F9C81B340E79F4D8F33D5DC069B01F433492C7EBED
    SPKI SHA256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CoSign by ARX CA

- Subject: countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 46F08CD8638A6F41A50855813990
- SHA-256: 740D5E17B4597635B5E1594FBA02C2B6D07F2E4731A5A91091E7044A817DBDB1
- SPKI SHA-256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
- Validity: 2015-08-19 to 2018-08-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:f0:8c:d8:63:8a:6f:41:a5:08:55:81:39:90
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Aug 19 00:00:00 2015 GMT
            Not After : Aug 19 00:00:00 2018 GMT
        Subject: C = US, ST = California, O = ARX Inc., CN = CoSign by ARX CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:3A:8D:3E:14:C5:AD:CD:17:0E:5A:6E:85:6E:8D:1A:FE:95:55:D0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.arx.com
                  email:arx.com
                  DNS:arx.com
                  DirName:C = US, ST = California, O = ARX Inc.
                  DirName:C = US, O = ARX Inc.
                  DirName:O = ARX Inc.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 740D5E17B4597635B5E1594FBA02C2B6D07F2E4731A5A91091E7044A817DBDB1
    SPKI SHA256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CoSign by ARX CA

- Subject: countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45DC9C7333771D79FB460F7A6328
- SHA-256: 30EC1942A183556C4F938167B481F5AEDCE4D1C4EE9F3BFFBD75CA76035FD81C
- SPKI SHA-256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
- Validity: 2014-11-26 to 2017-11-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:dc:9c:73:33:77:1d:79:fb:46:0f:7a:63:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Nov 26 00:00:00 2014 GMT
            Not After : Nov 26 00:00:00 2017 GMT
        Subject: C = US, ST = California, O = ARX Inc., CN = CoSign by ARX CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:3A:8D:3E:14:C5:AD:CD:17:0E:5A:6E:85:6E:8D:1A:FE:95:55:D0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.arx.com
                  email:arx.com
                  DNS:arx.com
                  DirName:C = US, ST = California, O = ARX Inc.
                  DirName:C = US, O = ARX Inc.
                  DirName:O = ARX Inc.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100

    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 30EC1942A183556C4F938167B481F5AEDCE4D1C4EE9F3BFFBD75CA76035FD81C
    SPKI SHA256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_tbs_signature_rsa_encryption_parameter_not_null: certificate tbsCertificate.signature RSA algorithm identifier missing required NULL parameter

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CoSign by ARX CA

- Subject: countryName=US, stateOrProvinceName=California, organizationName=ARX Inc., commonName=CoSign by ARX CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45D9AC8311B6505E442492CC83DA
- SHA-256: 14165D8E08D40CD6B479108725548B1A08016FDC2262267B82A0BC09D8931056
- SPKI SHA-256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
- Validity: 2014-11-25 to 2017-11-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: hhttp://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:d9:ac:83:11:b6:50:5e:44:24:92:cc:83:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Nov 25 10:00:00 2014 GMT
            Not After : Nov 25 10:00:00 2017 GMT
        Subject: C = US, ST = California, O = ARX Inc., CN = CoSign by ARX CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:3A:8D:3E:14:C5:AD:CD:17:0E:5A:6E:85:6E:8D:1A:FE:95:55:D0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.arx.com
                  email:arx.com
                  DNS:arx.com
                  DirName:C = US, ST = California, O = ARX Inc.
                  DirName:C = US, O = ARX Inc.
                  DirName:O = ARX Inc.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:hhttp://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100

    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 14165D8E08D40CD6B479108725548B1A08016FDC2262267B82A0BC09D8931056
    SPKI SHA256: 34B7026C865DA27EF64C8CA7A7DCB72E4B28B330FC799EBD6CB25960D60EF58B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: hhttp://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.arx.com","email:arx.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_tbs_signature_rsa_encryption_parameter_not_null: certificate tbsCertificate.signature RSA algorithm identifier missing required NULL parameter
- [historical] warn w_distribution_point_missing_ldap_or_uri: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CRB Group Atlas R45 SMIME CA 2025

- Subject: countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 82B764C7813B1E52A0B0B6F7291189B3
- SHA-256: 3C905753C59C45FFDA3E0B147C7E9165D4D1C6AFFD67CD1A20BC05E58D3B5BF6
- SPKI SHA-256: F15803A5C3C37C546FFC49DCC782EA6DD848C93F9982EC622DB4FA1291454B74
- Validity: 2025-01-22 to 2030-01-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/crbgroupatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:64:c7:81:3b:1e:52:a0:b0:b6:f7:29:11:89:b3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jan 22 04:05:38 2025 GMT
            Not After : Jan 22 00:00:00 2030 GMT
        Subject: C = US, O = "CRB Group, Inc.", CN = CRB Group Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:6E:F7:B7:70:0F:E7:AD:A4:24:6B:2C:3D:61:B6:D0:70:B9:F0:50
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C905753C59C45FFDA3E0B147C7E9165D4D1C6AFFD67CD1A20BC05E58D3B5BF6
    SPKI SHA256: F15803A5C3C37C546FFC49DCC782EA6DD848C93F9982EC622DB4FA1291454B74
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CRB Group GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9A4033AE6C9F998099F537F656
- SHA-256: 814179F36A71529C915C540261E44638E37A4FCE879740F0CE7351A8E9291A03
- SPKI SHA-256: 7749B8E4A50A88DE731BF16A03316015E6BE3F9757D49FC22569897ACB905E8C
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/crbgroupgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9a:40:33:ae:6c:9f:99:80:99:f5:37:f6:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = "CRB Group, Inc.", CN = CRB Group GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C9:25:49:E2:94:F6:69:DA:8F:52:0B:7A:CE:F9:B6:78:D5:CA:04:6B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 814179F36A71529C915C540261E44638E37A4FCE879740F0CE7351A8E9291A03
    SPKI SHA256: 7749B8E4A50A88DE731BF16A03316015E6BE3F9757D49FC22569897ACB905E8C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CRB Group GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC3725EBF34C10ABB48E01566F8A36
- SHA-256: E733E7E3E4AA765948CF4226391B49A72A0FEBF511E52DF96DF28398AFF61816
- SPKI SHA-256: 7749B8E4A50A88DE731BF16A03316015E6BE3F9757D49FC22569897ACB905E8C
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/crbgroupgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:25:eb:f3:4c:10:ab:b4:8e:01:56:6f:8a:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:30:48 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = "CRB Group, Inc.", CN = CRB Group GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C9:25:49:E2:94:F6:69:DA:8F:52:0B:7A:CE:F9:B6:78:D5:CA:04:6B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E733E7E3E4AA765948CF4226391B49A72A0FEBF511E52DF96DF28398AFF61816
    SPKI SHA256: 7749B8E4A50A88DE731BF16A03316015E6BE3F9757D49FC22569897ACB905E8C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CRB Group SMIME CA 2019

- Subject: countryName=US, organizationName=CRB Group, Inc., commonName=CRB Group SMIME CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 75A8BA9D403B1581B39B601F275704D1
- SHA-256: 6A5F4C1678CA65E59F060D57CDFF665065314861D53A8E7D1450CA92D96CA102
- SPKI SHA-256: E6E69C084AEB53D38AC6BA52FFA69364CB5A7632D6309153A1D628C89E128806
- Validity: 2019-10-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:9d:40:3b:15:81:b3:9b:60:1f:27:57:04:d1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Oct 22 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = "CRB Group, Inc.", CN = CRB Group SMIME CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1D:70:CD:15:4D:D5:E9:ED:5E:1F:64:5E:7A:D5:44:A4:46:F4:84:1B
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6A5F4C1678CA65E59F060D57CDFF665065314861D53A8E7D1450CA92D96CA102
    SPKI SHA256: E6E69C084AEB53D38AC6BA52FFA69364CB5A7632D6309153A1D628C89E128806
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CrowdStrike Atlas R46 OV TLS CA 2026

- Subject: countryName=US, organizationName=CrowdStrike, Inc., commonName=CrowdStrike Atlas R46 OV TLS CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85DB0E9A6697B48FC130B47DC66818F5
- SHA-256: B461A3FCE3498B3FA12ED9216887F33E3F1E7630C68172C30B440055DFC1C0EF
- SPKI SHA-256: 1004CB3E994CF8ABDA5DB9FB84FFC328DDB5C965EBFA42BF4B1E51CCF8338FDA
- Validity: 2026-05-20 to 2029-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/crowdstrikeatlasr46ovtlsca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:db:0e:9a:66:97:b4:8f:c1:30:b4:7d:c6:68:18:f5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: May 20 03:22:06 2026 GMT
            Not After : May 19 12:00:00 2029 GMT
        Subject: C = US, O = "CrowdStrike, Inc.", CN = CrowdStrike Atlas R46 OV TLS CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2E:BE:B8:A3:80:7C:C6:DB:12:8E:17:83:0E:16:CE:25:2B:87:C5:F5
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B461A3FCE3498B3FA12ED9216887F33E3F1E7630C68172C30B440055DFC1C0EF
    SPKI SHA256: 1004CB3E994CF8ABDA5DB9FB84FFC328DDB5C965EBFA42BF4B1E51CCF8338FDA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CrowdStrike GCC R3 TLS OV CA 2020

- Subject: countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike GCC R3 TLS OV CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031AA34FFCD118A7D91CCD5EEC5384
- SHA-256: 78CB512DE48CEDCD7134DF57C973C1E1A07692B8F542A44ACEBB8BB776D55D59
- SPKI SHA-256: 9F20ABDF869E1A8179343963322A410044D321043B4553F10F7038CF4F2CE92D
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/crowdstrikegccr3tlsovca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:a3:4f:fc:d1:18:a7:d9:1c:cd:5e:ec:53:84
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = CrowdStrike Inc., CN = CrowdStrike GCC R3 TLS OV CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                34:46:5A:C4:96:84:6B:11:D4:E7:09:30:AF:01:CA:A6:9D:3F:7D:96
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 78CB512DE48CEDCD7134DF57C973C1E1A07692B8F542A44ACEBB8BB776D55D59
    SPKI SHA256: 9F20ABDF869E1A8179343963322A410044D321043B4553F10F7038CF4F2CE92D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CrowdStrike GCC R46 OV TLS CA 2026

- Subject: countryName=US, organizationName=CrowdStrike, Inc., commonName=CrowdStrike GCC R46 OV TLS CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 86154A4EBDE77B0823B8F7E1220C8A3F
- SHA-256: C8C070934EC59DE5CFB9FBEF4AA7F28F9EC37E0CBA3D2F230AA01BACD01117F3
- SPKI SHA-256: 23074ECA2D96C0C7159C80789AB55134113F0D3EC1236283BB39BE075E1CD6AC
- Validity: 2026-06-24 to 2029-06-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:15:4a:4e:bd:e7:7b:08:23:b8:f7:e1:22:0c:8a:3f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jun 24 03:16:08 2026 GMT
            Not After : Jun 23 12:00:00 2029 GMT
        Subject: C = US, O = "CrowdStrike, Inc.", CN = CrowdStrike GCC R46 OV TLS CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:36:BB:D1:83:70:9A:BC:7A:2D:07:D6:25:50:DE:CB:F9:CD:90:B3
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C8C070934EC59DE5CFB9FBEF4AA7F28F9EC37E0CBA3D2F230AA01BACD01117F3
    SPKI SHA256: 23074ECA2D96C0C7159C80789AB55134113F0D3EC1236283BB39BE075E1CD6AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CrowdStrike GCC R6 OV TLS CA 2024

- Subject: countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike GCC R6 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD4BDC94CBAA3C822B3502BA17A5F
- SHA-256: EEC54317A352B48E50B8D94262D602E0441BDBA58FB2AE28741A56DEBF2336D3
- SPKI SHA-256: F956B8A58A572041B79A2F8F709BF6899349A8A07F2DCBC0FD781FBB8B66A2F7
- Validity: 2024-07-17 to 2030-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/crowdstrikegccr6ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d4:bd:c9:4c:ba:a3:c8:22:b3:50:2b:a1:7a:5f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:08:31 2024 GMT
            Not After : Jul 17 00:00:00 2030 GMT
        Subject: C = US, O = CrowdStrike Inc., CN = CrowdStrike GCC R6 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                33:32:6A:99:58:30:73:47:E3:03:9F:AE:19:A3:E4:0C:24:8A:FD:03
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EEC54317A352B48E50B8D94262D602E0441BDBA58FB2AE28741A56DEBF2336D3
    SPKI SHA256: F956B8A58A572041B79A2F8F709BF6899349A8A07F2DCBC0FD781FBB8B66A2F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CrowdStrike OV SSL Issuing CA 2020

- Subject: countryName=US, organizationName=CrowdStrike Inc., commonName=CrowdStrike OV SSL Issuing CA 2020
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 778E9A4120C221421E220646A43E35E9
- SHA-256: AE03B9AD17106A28785830B1DCD636797C4C64D81CB8D161595DBAF83433E64C
- SPKI SHA-256: 9474542FBCEA7077D2154CDB7745AA4593972B9EC4A92F0BE82E02266439369A
- Validity: 2020-05-20 to 2027-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:41:20:c2:21:42:1e:22:06:46:a4:3e:35:e9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : Apr 25 00:00:00 2027 GMT
        Subject: C = US, O = CrowdStrike Inc., CN = CrowdStrike OV SSL Issuing CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B8:D8:C1:75:6F:BB:05:F3:46:C1:F1:D7:A6:9C:9A:76:3E:A5:28:1E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AE03B9AD17106A28785830B1DCD636797C4C64D81CB8D161595DBAF83433E64C
    SPKI SHA256: 9474542FBCEA7077D2154CDB7745AA4593972B9EC4A92F0BE82E02266439369A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Crown Prince Court CA

- Subject: countryName=AE, stateOrProvinceName=Abu Dhabi, localityName=Abu Dhabi, organizationName=Crown Prince Court, commonName=Crown Prince Court CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 32AD0FEA8D371439340766E727E9983C6A
- SHA-256: 76EFCFADBD01F936E0C6980E563BB5E187AD39CE1AEEE7CEE7C772DC094F6598
- SPKI SHA-256: D30A9F8E612748D0BA7A1694FA51E4B1D2CAA05FF3FB1EB3890D6B4A8656C0D1
- Validity: 2012-12-13 to 2017-12-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:ad:0f:ea:8d:37:14:39:34:07:66:e7:27:e9:98:3c:6a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Dec 13 00:00:00 2012 GMT
            Not After : Dec 13 00:00:00 2017 GMT
        Subject: C = AE, ST = Abu Dhabi, L = Abu Dhabi, O = Crown Prince Court, CN = Crown Prince Court CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:cpc.gov.ae
                  DNS:cpc.ae
                  DNS:cpc.abudhabi.ae
                  DNS:mbzo.ae
                  DNS:hhsso.ae
                  email:cpc.gov.ae
                  email:cpc.ae
                  email:cpc.abudhabi.ae
                  email:mbzo.ae
                  email:hhsso.ae
                  DirName:C = AE, ST = Abu Dhabi, L = Abu Dhabi, O = Crown Prince Court
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                DD:A1:13:44:FF:13:25:76:D2:F1:4F:B0:06:CE:45:31:EC:02:EB:06
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 76EFCFADBD01F936E0C6980E563BB5E187AD39CE1AEEE7CEE7C772DC094F6598
    SPKI SHA256: D30A9F8E612748D0BA7A1694FA51E4B1D2CAA05FF3FB1EB3890D6B4A8656C0D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CUISEC GCC R3 TLS DV CA 2021

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS DV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE88AF961DCCEDC60E3AB6509F67
- SHA-256: 692FE1B8BA2699531DE4CD2F52AE38FA119AB01F4B31AB78FE6DB3FDF03A7031
- SPKI SHA-256: D46F1A35BD6847F2065E22F1DFE73706F911990D808CC601B47E341DE2C451DB
- Validity: 2021-04-21 to 2024-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cuisecgccr3tlsdvca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:88:af:96:1d:cc:ed:c6:0e:3a:b6:50:9f:67
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2024 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CUISEC GCC R3 TLS DV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:A8:83:78:5E:B4:E0:7C:84:D2:D2:13:CA:04:8D:AC:D1:46:13:4D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 692FE1B8BA2699531DE4CD2F52AE38FA119AB01F4B31AB78FE6DB3FDF03A7031
    SPKI SHA256: D46F1A35BD6847F2065E22F1DFE73706F911990D808CC601B47E341DE2C451DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CUISEC GCC R3 TLS EV CA 2021

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS EV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE9042A0D27CFA088C5A28EC3EB8
- SHA-256: 9BFABD8D91284500B4D412C5725C87CB3A013F940FF1E62810E6929C69393ED9
- SPKI SHA-256: F552451845ABA3B5F9EA7DB4BBF622777BA2B480FE16DC2E8EB5CF25DFD4522F
- Validity: 2021-04-21 to 2024-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cuisecgccr3tlsevca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:90:42:a0:d2:7c:fa:08:8c:5a:28:ec:3e:b8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2024 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CUISEC GCC R3 TLS EV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D8:C0:BE:DC:E7:0F:13:2A:24:27:4E:EE:4A:C1:FF:16:CF:3A:E6:33
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9BFABD8D91284500B4D412C5725C87CB3A013F940FF1E62810E6929C69393ED9
    SPKI SHA256: F552451845ABA3B5F9EA7DB4BBF622777BA2B480FE16DC2E8EB5CF25DFD4522F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CUISEC GCC R3 TLS OV CA 2021

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CUISEC GCC R3 TLS OV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE8A91808A7F559035EC0E8D72CF
- SHA-256: C7F145D474F5DC20B27A64E1696179522469078B333FE8FF887B97CE7805E362
- SPKI SHA-256: EC2B55DAAFC31B69ADD6AEC235A317E4B6325CB579978EFB98C7238D866CDAEE
- Validity: 2021-04-21 to 2024-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cuisecgccr3tlsovca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:8a:91:80:8a:7f:55:90:35:ec:0e:8d:72:cf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2024 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CUISEC GCC R3 TLS OV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:72:2C:EA:3C:CD:B1:8E:49:FF:DC:02:30:40:2C:E8:B6:69:48:2C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7F145D474F5DC20B27A64E1696179522469078B333FE8FF887B97CE7805E362
    SPKI SHA256: EC2B55DAAFC31B69ADD6AEC235A317E4B6325CB579978EFB98C7238D866CDAEE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Danske Bank Group

- Subject: countryName=DK, organizationName=Danske Bank A/S, organizationalUnitName=Messaging Security, commonName=Danske Bank Group
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000012CCFFBAA39
- SHA-256: 075F849A9909312313210469E42582755BCAF104C72C4B6791B6339C9425A851
- SPKI SHA-256: AFC8069E02BFD0378AB98AEACB1220C33CE9A8E1923DDE60EF7E9A35AF0A0A18
- Validity: 2010-12-10 to 2020-12-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2c:cf:fb:aa:39
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec 10 10:00:00 2010 GMT
            Not After : Dec 10 10:00:00 2020 GMT
        Subject: C = DK, O = Danske Bank A/S, OU = Messaging Security, CN = Danske Bank Group
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D9:64:45:00:CA:88:7C:87:ED:0B:68:18:69:D9:F0:C1:2B:5D:A4:12
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: http://www.danskebank.com/messagingsecurity/Certificate-Practice-Statement.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 075F849A9909312313210469E42582755BCAF104C72C4B6791B6339C9425A851
    SPKI SHA256: AFC8069E02BFD0378AB98AEACB1220C33CE9A8E1923DDE60EF7E9A35AF0A0A18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DexKo Global GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9A89405D6A73115F03F3175AEC
- SHA-256: D531F24E655D1F28A344BD3E0E9B141CE88A4139C61CB0CF5184EF2E2B9531A7
- SPKI SHA-256: CFEFE635A6D615291842D88A294CBDFFC3B665DC0C573630AB2AF6AC8530014B
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/dexkoglobalgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9a:89:40:5d:6a:73:11:5f:03:f3:17:5a:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = DexKo Global Inc., CN = DexKo Global GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3D:EF:41:F0:9D:E5:D7:AA:EB:B5:22:34:3B:DE:78:CD:70:80:80:0D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D531F24E655D1F28A344BD3E0E9B141CE88A4139C61CB0CF5184EF2E2B9531A7
    SPKI SHA256: CFEFE635A6D615291842D88A294CBDFFC3B665DC0C573630AB2AF6AC8530014B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DexKo Global GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC3722262D6CD09209A28D1E34882F
- SHA-256: 6C450398A321440532FE2FA41B31ABF13ADA8A94274D0397E6F24D18CED77A66
- SPKI SHA-256: CFEFE635A6D615291842D88A294CBDFFC3B665DC0C573630AB2AF6AC8530014B
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/dexkoglobalgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:22:26:2d:6c:d0:92:09:a2:8d:1e:34:88:2f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:30:45 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = DexKo Global Inc., CN = DexKo Global GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3D:EF:41:F0:9D:E5:D7:AA:EB:B5:22:34:3B:DE:78:CD:70:80:80:0D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6C450398A321440532FE2FA41B31ABF13ADA8A94274D0397E6F24D18CED77A66
    SPKI SHA256: CFEFE635A6D615291842D88A294CBDFFC3B665DC0C573630AB2AF6AC8530014B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DexKo Global SMIME CA 2019

- Subject: countryName=US, organizationName=DexKo Global Inc., commonName=DexKo Global SMIME CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 75A8BA9D5D721013B253F5B29B575A21
- SHA-256: ABC86706C98D6BF67372F908EC01ADF631B191D733AE89F8343EB047B108144B
- SPKI SHA-256: 0078DD957F3F7A5F0208BCF924A99F04E30CBE624FC7BB75F73E7C0B0F736E78
- Validity: 2019-10-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:9d:5d:72:10:13:b2:53:f5:b2:9b:57:5a:21
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Oct 22 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = DexKo Global Inc., CN = DexKo Global SMIME CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7D:EB:19:70:DA:E8:75:B8:EB:ED:66:9D:98:BD:04:DB:93:20:72:42
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ABC86706C98D6BF67372F908EC01ADF631B191D733AE89F8343EB047B108144B
    SPKI SHA256: 0078DD957F3F7A5F0208BCF924A99F04E30CBE624FC7BB75F73E7C0B0F736E78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DHL Client Auth CA I6

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Client Auth CA I6
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 83148A2834C77B4A311331222A26CE92
- SHA-256: EFEEC917B8383B48878AD40B09DFDC0C4698DF0DAF43C4B47474CB3C02B06A18
- SPKI SHA-256: D338EFA6237431BA3C282CBD17CD12C2BC856B1C187526B0CB70DA6309076762
- Validity: 2025-03-19 to 2035-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlclientauthcai6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:8a:28:34:c7:7b:4a:31:13:31:22:2a:26:ce:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Mar 19 03:32:35 2025 GMT
            Not After : Mar 19 00:00:00 2035 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DHL Client Auth CA I6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                49:27:0E:51:8C:F1:03:7A:ED:15:CE:8C:BD:45:69:D8:68:B4:36:B3
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EFEEC917B8383B48878AD40B09DFDC0C4698DF0DAF43C4B47474CB3C02B06A18
    SPKI SHA256: D338EFA6237431BA3C282CBD17CD12C2BC856B1C187526B0CB70DA6309076762
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DHL Global TLS CA I6

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Global TLS CA I6
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84435852A4652ED24CE5945B5CF618B1
- SHA-256: 1DA78383D55F801C4AF4B9CF8ADF149155C1E605E13838492812F75A4E6AF7E5
- SPKI SHA-256: BBCE3317237C98555D77F0D509361219E208AB69A7BC106F6E698E72401CC5B3
- Validity: 2025-09-17 to 2035-09-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlglobaltlscai6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:52:a4:65:2e:d2:4c:e5:94:5b:5c:f6:18:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Sep 17 02:55:07 2025 GMT
            Not After : Sep 17 00:00:00 2035 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DHL Global TLS CA I6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:F9:EC:F1:98:FD:D0:84:83:FF:3F:96:18:F9:2F:5A:B8:77:15:93
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1DA78383D55F801C4AF4B9CF8ADF149155C1E605E13838492812F75A4E6AF7E5
    SPKI SHA256: BBCE3317237C98555D77F0D509361219E208AB69A7BC106F6E698E72401CC5B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DHL Secure Mail CA I6

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DHL Secure Mail CA I6
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 83148A316E8507055F8EFCAC16CFAABF
- SHA-256: 333729B23AE4506C32E80C654C66EC7B2D1BBC7A923A216F48A7C62A46B52414
- SPKI SHA-256: 9B07087E019B28EB711C645D810CE6C2D54A29FDAD2366A1C4E3E00350CE0B3E
- Validity: 2025-03-19 to 2035-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlsecuremailcai6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 2.23.140.1.5.2.3, 1.3.6.1.4.1.4146.10.3.1, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:8a:31:6e:85:07:05:5f:8e:fc:ac:16:cf:aa:bf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Mar 19 03:32:42 2025 GMT
            Not After : Mar 19 00:00:00 2035 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DHL Secure Mail CA I6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2D:AF:E6:17:B0:A9:DA:84:7D:1E:37:5E:BA:CF:5C:5A:50:9D:47:B5
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.2.3
                Policy: 1.3.6.1.4.1.4146.10.3.1
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 333729B23AE4506C32E80C654C66EC7B2D1BBC7A923A216F48A7C62A46B52414
    SPKI SHA256: 9B07087E019B28EB711C645D810CE6C2D54A29FDAD2366A1C4E3E00350CE0B3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 2.23.140.1.5.2.3, 1.3.6.1.4.1.4146.10.3.1, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DPDHL Global TLS CA - I4

- Subject: countryName=DE, organizationName=Deutsche Post AG, localityName=Bonn, stateOrProvinceName=Nordrhein-Westfalen, commonName=DPDHL Global TLS CA - I4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 75A8B9B5231B9F950AED62BAFB467147
- SHA-256: 94C663E9EA5C27EE4F64127F9B425863E991A9E156C07DF1A00803AE31764162
- SPKI SHA-256: 7430B3CD114D44A9CCAC7445653ECF4EDD21B8E537B537414FED3D8F8428D1DC
- Validity: 2019-08-21 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:b9:b5:23:1b:9f:95:0a:ed:62:ba:fb:46:71:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 21 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, L = Bonn, ST = Nordrhein-Westfalen, CN = DPDHL Global TLS CA - I4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8E:3F:2E:A8:3C:A7:8D:2F:64:06:60:93:03:99:38:4B:09:86:3E:A3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 94C663E9EA5C27EE4F64127F9B425863E991A9E156C07DF1A00803AE31764162
    SPKI SHA256: 7430B3CD114D44A9CCAC7445653ECF4EDD21B8E537B537414FED3D8F8428D1DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp

### DPDHL Global TLS CA - I5

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL Global TLS CA - I5
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 77BD0DDF6384FFB1D14A3EDD8383C869
- SHA-256: 32A4E554E363116FE48E22F01DAC1736752A71C720F99F462D565022D3BAD07D
- SPKI SHA-256: F744A44878E7E94B987D00AFBA7C6E55FEED1D027763BFBF6AE917CEEF92D3F3
- Validity: 2020-07-11 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhltlscai5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:df:63:84:ff:b1:d1:4a:3e:dd:83:83:c8:69
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 11 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DPDHL Global TLS CA - I5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EF:5B:F4:4B:86:F9:D6:F9:3A:53:89:09:BC:20:8E:BC:1A:CA:22:60
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 32A4E554E363116FE48E22F01DAC1736752A71C720F99F462D565022D3BAD07D
    SPKI SHA256: F744A44878E7E94B987D00AFBA7C6E55FEED1D027763BFBF6AE917CEEF92D3F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DPDHL TLS CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 2078F77A210ADCAD57AE9BB5BAFB41BAF1
- SHA-256: B9098CB2BF70B60E4BA6FBB4EFB57846BFD1BE126BFB417AF40CB2966F78A521
- SPKI SHA-256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
- Validity: 2013-09-03 to 2018-09-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:78:f7:7a:21:0a:dc:ad:57:ae:9b:b5:ba:fb:41:ba:f1
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Sep  3 00:00:00 2013 GMT
            Not After : Sep  3 00:00:00 2018 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL TLS CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:adressdialog.de
                  DNS:adress-research.de
                  DNS:aerologic.aero
                  DNS:allesnebenan.de
                  DNS:cathaypacific.com
                  DNS:clear-mail.de
                  DNS:clixmix.de
                  DNS:covis.de
                  DNS:deutschepost.de
                  DNS:deutschepost-safe-online.de
                  DNS:deutsche-sammlermuenzen.de
                  DNS:dhl.at
                  DNS:dhl.ch
                  DNS:dhl.co.uk
                  DNS:dhl.com
                  DNS:dhl.com.co
                  DNS:dhl.com.hk
                  DNS:dhl.com.pl
                  DNS:dhl.de
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.nl
                  DNS:dhlbenelux.nl
                  DNS:dhl-businessportal.com
                  DNS:dhl-corporate-wear.com
                  DNS:dhldashboard.se
                  DNS:dhl-delivernow.de
                  DNS:dhleuronetstatus.com
                  DNS:dhlexpresseasy.se
                  DNS:dhlexternal.com
                  DNS:dhlfreight.dk
                  DNS:dhlfreight.ee
                  DNS:dhlfreight.fi
                  DNS:dhlfreight.lv
                  DNS:dhlfreight.no
                  DNS:dhlfreight.se
                  DNS:dhl-geschaeftskundenportal.de
                  DNS:dhlglobalmail.co.uk
                  DNS:dhlglobalmail.com
                  DNS:dhl-globalmail.com
                  DNS:dhlitnow.com
                  DNS:dhl-kundenaufschaltung.de
                  DNS:dhlservicecenter.se
                  DNS:dhlservicepoint.se
                  DNS:dhlservices.it
                  DNS:dhltweb.com
                  DNS:dhl-usa.com
                  DNS:dhl-versandportal.de
                  DNS:dhl-webchecker.de
                  DNS:dhlwebport.com
                  DNS:dienstleisterkatalog.de
                  DNS:dieredaktion.de
                  DNS:direktmarketingcenter.de
                  DNS:direktplus.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dp-dhl.com
                  DNS:dpdhl.de
                  DNS:dp-dhl.de
                  DNS:dp-itsolutions.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnref.com
                  DNS:e-datagate.de
                  DNS:efiliale.de
                  DNS:einkaufaktuell.de
                  DNS:epost.de
                  DNS:epost-gka.de
                  DNS:exel.com
                  DNS:expresseasy.se
                  DNS:filialkommunikation.de
                  DNS:forumgelb.de
                  DNS:globalmail-pit.com
                  DNS:ibgstarshop.it
                  DNS:intraship.ch
                  DNS:intraship.de
                  DNS:intraship-dhl.at
                  DNS:intraship-dhl.be
                  DNS:intraship-dhl.co.uk
                  DNS:intraship-dhl.ee
                  DNS:intraship-dhl.fi
                  DNS:intraship-dhl.gr
                  DNS:intraship-dhl.ie
                  DNS:intraship-dhl.lt
                  DNS:intraship-dhl.lu
                  DNS:intraship-dhl.lv
                  DNS:intraship-dhl.nl
                  DNS:leserkiosk.de
                  DNS:leserservice.de
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:letternet.de
                  DNS:letternet-bo.de
                  DNS:letternet-ref.de
                  DNS:mailingfactory.de
                  DNS:mediamail.de
                  DNS:meinpaket.de
                  DNS:mrsc.info
                  DNS:mybill.dhl.co.il
                  DNS:onlinefrankierung.de
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:partnerportal-deutschepost.de
                  DNS:portokalkulator.de
                  DNS:post.de
                  DNS:postadress.de
                  DNS:postdirekt.de
                  DNS:postofficeshop.de
                  DNS:post-partner-shop.de
                  DNS:printcom.de
                  DNS:printtrack.de
                  DNS:rentenservice.com
                  DNS:schreibcenter.de
                  DNS:smartsensor-temperature.net
                  DNS:socialmemories.com
                  DNS:telegramm.de
                  DNS:vgl.nl
                  DNS:wlds.de
                  DNS:worldservicecentre.com
                  DNS:bluedart.com
                  DNS:dhl-eship.nl
                  DNS:dhl-etrack.nl
                  DNS:dhl-internettrack.nl
                  DNS:dhlretouropdracht.nl
                  DNS:dhlspeedpack.be
                  DNS:dhl-tracknet.nl
                  DNS:intraship-dhl.hu
                  DNS:servicepoint.se
                  DNS:umziehen.de
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                C8:03:02:DE:C0:B1:AB:83:C5:1E:FE:07:F7:78:BD:E5:83:04:88:7D
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B9098CB2BF70B60E4BA6FBB4EFB57846BFD1BE126BFB417AF40CB2966F78A521
    SPKI SHA256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL TLS CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 2C0548166D0C599607F92BFC55FF88AA43
- SHA-256: A1CB90251916A67885D59174C7FA5CDEB18A71510A47335F406309F25E012E0E
- SPKI SHA-256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
- Validity: 2014-09-03 to 2019-09-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:05:48:16:6d:0c:59:96:07:f9:2b:fc:55:ff:88:aa:43
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Sep  3 00:00:00 2014 GMT
            Not After : Sep  3 00:00:00 2019 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL TLS CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:adac-postbus.de
                  DNS:aerocar.nl
                  DNS:barclayscapitalcommunications.com
                  DNS:barclayscommunications.com
                  DNS:contentconverter-cont-test.de
                  DNS:contentconverter.de
                  DNS:contentconverter-test.de
                  DNS:deliveryorder.co.uk
                  DNS:dhlactivity.com
                  DNS:dhl-appsdev.net
                  DNS:dhl-apps.net
                  DNS:dhl-appsstaging.net
                  DNS:dhl.ca
                  DNS:dhl.co.kr
                  DNS:dhl.com.mx
                  DNS:dhl.com.sv
                  DNS:dhl.com.tr
                  DNS:dhl-deliverit.com
                  DNS:dhl-delivernow.ch
                  DNS:dhl-discoverlogistics.com
                  DNS:dhl.dk
                  DNS:dhldomestic.co.uk
                  DNS:dhleasydesk.nl
                  DNS:dhl-fanshop.com
                  DNS:dhl.fr
                  DNS:dhlfreight.lt
                  DNS:dhlgemist.nl
                  DNS:dhl-globalmail.fr
                  DNS:dhl-innovationroom.com
                  DNS:dhl.it
                  DNS:dhl.lv
                  DNS:dhloverflow.com
                  DNS:dhlparcel.be
                  DNS:dhlparcel.lu
                  DNS:dhlparcel.nl
                  DNS:dhlring.com
                  DNS:dhl.ru
                  DNS:dhlsameday.com
                  DNS:dhl.se
                  DNS:dhl-shiptrack.com
                  DNS:dhlstatus.com
                  DNS:dhltoolboxtest.se
                  DNS:die-redaktion.de
                  DNS:docwallet.com
                  DNS:docwallet.de
                  DNS:dp-dhl-ic.com
                  DNS:dpdhl-personalentwicklung.de
                  DNS:dpdhlpromotional-items.com
                  DNS:dp-ds.de
                  DNS:dpeps.de
                  DNS:dpfleet.com
                  DNS:dpfleet.de
                  DNS:dpwnbc.net
                  DNS:dpzahlungsdienste.de
                  DNS:einfacher-werben.de
                  DNS:epostbusinessmailer.net
                  DNS:epost-dev.de
                  DNS:epostscan.de
                  DNS:fieldtrip.tv
                  DNS:funcard.de
                  DNS:fwlteam.com
                  DNS:gerlachcs.com
                  DNS:grusskarten-bestellen.de
                  DNS:hrd-brief-online.de
                  DNS:infopost-manager.de
                  DNS:intraship-dhl.cz
                  DNS:intraship-dhl.it
                  DNS:intraship-dhl.si
                  DNS:intraship-dhl.sk
                  DNS:laible.ch
                  DNS:lifeconex.com
                  DNS:madoni-stores.com
                  DNS:mydhl.it
                  DNS:myways.com
                  DNS:myways.de
                  DNS:myways.nl
                  DNS:myways.se
                  DNS:paketkurier.de
                  DNS:paysmart.de
                  DNS:pe-konzern-deutschland.de
                  DNS:post-individuell.de
                  DNS:postpay.de
                  DNS:premiumadress.de
                  DNS:prospekt-service.de
                  DNS:prospektservice.de
                  DNS:selektvracht.nl
                  DNS:servicepointeuropa.se
                  DNS:servicepointinrikes.se
                  DNS:smokeandmirrorsdesign.co.uk
                  DNS:smoke-mirrors.co.uk
                  DNS:supplychain.nhs.uk
                  DNS:tagworldwide.biz
                  DNS:tagworldwide.com
                  DNS:tasmancargo.net
                  DNS:thegazette.co.uk
                  DNS:theso.co.uk
                  DNS:tso.co.uk
                  DNS:umzugservice.com
                  DNS:van-swieten.com
                  DNS:verongrauer.com
                  DNS:vetsch.net
                  DNS:williamslea.com
                  DNS:williamslea.co.uk
                  DNS:williamslea.net
                  DNS:wlcis.net
                  DNS:yellow-sky.com
                  DNS:adressdialog.de
                  DNS:adress-research.de
                  DNS:aerologic.aero
                  DNS:allesnebenan.de
                  DNS:clear-mail.de
                  DNS:clixmix.de
                  DNS:deutschepost.de
                  DNS:deutschepost-safe-online.de
                  DNS:deutsche-sammlermuenzen.de
                  DNS:dhl.at
                  DNS:dhl.ch
                  DNS:dhl.co.uk
                  DNS:dhl.com
                  DNS:dhl.com.co
                  DNS:dhl.com.hk
                  DNS:dhl.com.pl
                  DNS:dhl.de
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.nl
                  DNS:dhlbenelux.nl
                  DNS:dhl-businessportal.com
                  DNS:dhl-corporate-wear.com
                  DNS:dhldashboard.se
                  DNS:dhl-delivernow.de
                  DNS:dhleuronetstatus.com
                  DNS:dhlexpresseasy.se
                  DNS:dhlexternal.com
                  DNS:dhlfreight.dk
                  DNS:dhlfreight.ee
                  DNS:dhlfreight.fi
                  DNS:dhlfreight.lv
                  DNS:dhlfreight.no
                  DNS:dhlfreight.se
                  DNS:dhl-geschaeftskundenportal.de
                  DNS:dhlglobalmail.co.uk
                  DNS:dhlglobalmail.com
                  DNS:dhl-globalmail.com
                  DNS:dhlitnow.com
                  DNS:dhl-kundenaufschaltung.de
                  DNS:dhlservicecenter.se
                  DNS:dhlservicepoint.se
                  DNS:dhlservices.it
                  DNS:dhltweb.com
                  DNS:dhl-usa.com
                  DNS:dhl-versandportal.de
                  DNS:dhl-webchecker.de
                  DNS:dhlwebport.com
                  DNS:dienstleisterkatalog.de
                  DNS:dieredaktion.de
                  DNS:direktmarketingcenter.de
                  DNS:direktplus.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dp-dhl.com
                  DNS:dpdhl.de
                  DNS:dp-dhl.de
                  DNS:dp-itsolutions.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnref.com
                  DNS:e-datagate.de
                  DNS:efiliale.de
                  DNS:einkaufaktuell.de
                  DNS:epost.de
                  DNS:epost-gka.de
                  DNS:exel.com
                  DNS:expresseasy.se
                  DNS:filialkommunikation.de
                  DNS:forumgelb.de
                  DNS:globalmail-pit.com
                  DNS:ibgstarshop.it
                  DNS:intraship.ch
                  DNS:intraship.de
                  DNS:intraship-dhl.at
                  DNS:intraship-dhl.be
                  DNS:intraship-dhl.co.uk
                  DNS:intraship-dhl.ee
                  DNS:intraship-dhl.fi
                  DNS:intraship-dhl.gr
                  DNS:intraship-dhl.ie
                  DNS:intraship-dhl.lt
                  DNS:intraship-dhl.lu
                  DNS:intraship-dhl.lv
                  DNS:intraship-dhl.nl
                  DNS:leserkiosk.de
                  DNS:leserservice.de
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:letternet.de
                  DNS:letternet-bo.de
                  DNS:letternet-ref.de
                  DNS:mailingfactory.de
                  DNS:mediamail.de
                  DNS:meinpaket.de
                  DNS:mrsc.info
                  DNS:mybill.dhl.co.il
                  DNS:onlinefrankierung.de
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:partnerportal-deutschepost.de
                  DNS:portokalkulator.de
                  DNS:post.de
                  DNS:postadress.de
                  DNS:postdirekt.de
                  DNS:postofficeshop.de
                  DNS:post-partner-shop.de
                  DNS:printcom.de
                  DNS:printtrack.de
                  DNS:rentenservice.com
                  DNS:schreibcenter.de
                  DNS:smartsensor-temperature.net
                  DNS:socialmemories.com
                  DNS:telegramm.de
                  DNS:vgl.nl
                  DNS:wlds.de
                  DNS:worldservicecentre.com
                  DNS:bluedart.com
                  DNS:dhl-eship.nl
                  DNS:dhl-etrack.nl
                  DNS:dhl-internettrack.nl
                  DNS:dhlretouropdracht.nl
                  DNS:dhlspeedpack.be
                  DNS:dhl-tracknet.nl
                  DNS:intraship-dhl.hu
                  DNS:servicepoint.se
                  DNS:umziehen.de
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                C8:03:02:DE:C0:B1:AB:83:C5:1E:FE:07:F7:78:BD:E5:83:04:88:7D
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A1CB90251916A67885D59174C7FA5CDEB18A71510A47335F406309F25E012E0E
    SPKI SHA256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL TLS CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationalUnitName=IT Services, organizationName=Deutsche Post DHL, commonName=DPDHL TLS CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 45559379BE442AA13B732ECC503DA82773
- SHA-256: 5FFDEDE82957B43D4676B1CFCC39CEB150DC63DBFC33E26D99CAA9B9762A4564
- SPKI SHA-256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
- Validity: 2013-04-18 to 2018-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:55:93:79:be:44:2a:a1:3b:73:2e:cc:50:3d:a8:27:73
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Apr 18 00:00:00 2013 GMT
            Not After : Apr 18 00:00:00 2018 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, OU = IT Services, O = Deutsche Post DHL, CN = DPDHL TLS CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:adressdialog.de
                  DNS:adress-research.de
                  DNS:aerologic.aero
                  DNS:allesnebenan.de
                  DNS:cathaypacific.com
                  DNS:clear-mail.de
                  DNS:clixmix.de
                  DNS:covis.de
                  DNS:deutschepost.de
                  DNS:deutschepost.local
                  DNS:deutschepost-safe-online.de
                  DNS:deutsche-sammlermuenzen.de
                  DNS:dhl.at
                  DNS:dhl.ch
                  DNS:dhl.co.uk
                  DNS:dhl.com
                  DNS:dhl.com.co
                  DNS:dhl.com.hk
                  DNS:dhl.com.pl
                  DNS:dhl.de
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.nl
                  DNS:dhlbenelux.nl
                  DNS:dhl-businessportal.com
                  DNS:dhl-corporate-wear.com
                  DNS:dhldashboard.se
                  DNS:dhl-delivernow.de
                  DNS:dhleuronetstatus.com
                  DNS:dhlexpresseasy.se
                  DNS:dhlexternal.com
                  DNS:dhlfreight.dk
                  DNS:dhlfreight.ee
                  DNS:dhlfreight.fi
                  DNS:dhlfreight.lv
                  DNS:dhlfreight.no
                  DNS:dhlfreight.se
                  DNS:dhl-geschaeftskundenportal.de
                  DNS:dhlglobalmail.co.uk
                  DNS:dhlglobalmail.com
                  DNS:dhl-globalmail.com
                  DNS:dhlitnow.com
                  DNS:dhl-kundenaufschaltung.de
                  DNS:dhlservicecenter.se
                  DNS:dhlservicepoint.se
                  DNS:dhlservices.it
                  DNS:dhltweb.com
                  DNS:dhl-usa.com
                  DNS:dhl-versandportal.de
                  DNS:dhl-webchecker.de
                  DNS:dhlwebport.com
                  DNS:dienstleisterkatalog.de
                  DNS:dieredaktion.de
                  DNS:direktmarketingcenter.de
                  DNS:direktplus.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dp-dhl.com
                  DNS:dpdhl.de
                  DNS:dp-dhl.de
                  DNS:dp-itsolutions.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnref.com
                  DNS:e-datagate.de
                  DNS:efiliale.de
                  DNS:einkaufaktuell.de
                  DNS:epost.de
                  DNS:epost-gka.de
                  DNS:exel.com
                  DNS:expresseasy.se
                  DNS:filialkommunikation.de
                  DNS:forumgelb.de
                  DNS:globalmail-pit.com
                  DNS:ibgstarshop.it
                  DNS:intraship.ch
                  DNS:intraship.de
                  DNS:intraship-dhl.at
                  DNS:intraship-dhl.be
                  DNS:intraship-dhl.co.uk
                  DNS:intraship-dhl.ee
                  DNS:intraship-dhl.fi
                  DNS:intraship-dhl.gr
                  DNS:intraship-dhl.ie
                  DNS:intraship-dhl.lt
                  DNS:intraship-dhl.lu
                  DNS:intraship-dhl.lv
                  DNS:intraship-dhl.nl
                  DNS:leserkiosk.de
                  DNS:leserservice.de
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:letternet.de
                  DNS:letternet-bo.de
                  DNS:letternet-ref.de
                  DNS:mailingfactory.de
                  DNS:mediamail.de
                  DNS:meinpaket.de
                  DNS:mrsc.info
                  DNS:mybill.dhl.co.il
                  DNS:onlinefrankierung.de
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:partnerportal-deutschepost.de
                  DNS:portokalkulator.de
                  DNS:post.de
                  DNS:postadress.de
                  DNS:postdirekt.de
                  DNS:postofficeshop.de
                  DNS:post-partner-shop.de
                  DNS:printcom.de
                  DNS:printtrack.de
                  DNS:rentenservice.com
                  DNS:schreibcenter.de
                  DNS:smartsensor-temperature.net
                  DNS:socialmemories.com
                  DNS:telegramm.de
                  DNS:vgl.nl
                  DNS:wlds.de
                  DNS:worldservicecentre.com
                  DNS:bluedart.com
                  DNS:dhl-eship.nl
                  DNS:dhl-etrack.nl
                  DNS:dhl-internettrack.nl
                  DNS:dhlretouropdracht.nl
                  DNS:dhlspeedpack.be
                  DNS:dhl-tracknet.nl
                  DNS:intraship-dhl.hu
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:letternet-ref.de
                  DNS:onlinefrankierung.de
                  DNS:partnerportal-deutschepost.de
                  DNS:servicepoint.se
                  DNS:umziehen.de
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                C8:03:02:DE:C0:B1:AB:83:C5:1E:FE:07:F7:78:BD:E5:83:04:88:7D
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5FFDEDE82957B43D4676B1CFCC39CEB150DC63DBFC33E26D99CAA9B9762A4564
    SPKI SHA256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL TLS CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 40CD73678199E207F0A50B546327B735ED
- SHA-256: 6061F773354CD2ED5613A094AB0E8270D5C2479932B42DFDA727DB83FEBD18B8
- SPKI SHA-256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
- Validity: 2013-07-16 to 2018-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:cd:73:67:81:99:e2:07:f0:a5:0b:54:63:27:b7:35:ed
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Jul 16 00:00:00 2013 GMT
            Not After : Jul 16 00:00:00 2018 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL TLS CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:adressdialog.de
                  DNS:adress-research.de
                  DNS:aerologic.aero
                  DNS:allesnebenan.de
                  DNS:cathaypacific.com
                  DNS:clear-mail.de
                  DNS:clixmix.de
                  DNS:covis.de
                  DNS:deutschepost.de
                  DNS:deutschepost.local
                  DNS:deutschepost-safe-online.de
                  DNS:deutsche-sammlermuenzen.de
                  DNS:dhl.at
                  DNS:dhl.ch
                  DNS:dhl.co.uk
                  DNS:dhl.com
                  DNS:dhl.com.co
                  DNS:dhl.com.hk
                  DNS:dhl.com.pl
                  DNS:dhl.de
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.nl
                  DNS:dhlbenelux.nl
                  DNS:dhl-businessportal.com
                  DNS:dhl-corporate-wear.com
                  DNS:dhldashboard.se
                  DNS:dhl-delivernow.de
                  DNS:dhleuronetstatus.com
                  DNS:dhlexpresseasy.se
                  DNS:dhlexternal.com
                  DNS:dhlfreight.dk
                  DNS:dhlfreight.ee
                  DNS:dhlfreight.fi
                  DNS:dhlfreight.lv
                  DNS:dhlfreight.no
                  DNS:dhlfreight.se
                  DNS:dhl-geschaeftskundenportal.de
                  DNS:dhlglobalmail.co.uk
                  DNS:dhlglobalmail.com
                  DNS:dhl-globalmail.com
                  DNS:dhlitnow.com
                  DNS:dhl-kundenaufschaltung.de
                  DNS:dhlservicecenter.se
                  DNS:dhlservicepoint.se
                  DNS:dhlservices.it
                  DNS:dhltweb.com
                  DNS:dhl-usa.com
                  DNS:dhl-versandportal.de
                  DNS:dhl-webchecker.de
                  DNS:dhlwebport.com
                  DNS:dienstleisterkatalog.de
                  DNS:dieredaktion.de
                  DNS:direktmarketingcenter.de
                  DNS:direktplus.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dp-dhl.com
                  DNS:dpdhl.de
                  DNS:dp-dhl.de
                  DNS:dp-itsolutions.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnref.com
                  DNS:e-datagate.de
                  DNS:efiliale.de
                  DNS:einkaufaktuell.de
                  DNS:epost.de
                  DNS:epost-gka.de
                  DNS:exel.com
                  DNS:expresseasy.se
                  DNS:filialkommunikation.de
                  DNS:forumgelb.de
                  DNS:globalmail-pit.com
                  DNS:ibgstarshop.it
                  DNS:intraship.ch
                  DNS:intraship.de
                  DNS:intraship-dhl.at
                  DNS:intraship-dhl.be
                  DNS:intraship-dhl.co.uk
                  DNS:intraship-dhl.ee
                  DNS:intraship-dhl.fi
                  DNS:intraship-dhl.gr
                  DNS:intraship-dhl.ie
                  DNS:intraship-dhl.lt
                  DNS:intraship-dhl.lu
                  DNS:intraship-dhl.lv
                  DNS:intraship-dhl.nl
                  DNS:leserkiosk.de
                  DNS:leserservice.de
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:letternet.de
                  DNS:letternet-bo.de
                  DNS:letternet-ref.de
                  DNS:mailingfactory.de
                  DNS:mediamail.de
                  DNS:meinpaket.de
                  DNS:mrsc.info
                  DNS:mybill.dhl.co.il
                  DNS:onlinefrankierung.de
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:partnerportal-deutschepost.de
                  DNS:portokalkulator.de
                  DNS:post.de
                  DNS:postadress.de
                  DNS:postdirekt.de
                  DNS:postofficeshop.de
                  DNS:post-partner-shop.de
                  DNS:printcom.de
                  DNS:printtrack.de
                  DNS:rentenservice.com
                  DNS:schreibcenter.de
                  DNS:smartsensor-temperature.net
                  DNS:socialmemories.com
                  DNS:telegramm.de
                  DNS:vgl.nl
                  DNS:wlds.de
                  DNS:worldservicecentre.com
                  DNS:bluedart.com
                  DNS:dhl-eship.nl
                  DNS:dhl-etrack.nl
                  DNS:dhl-internettrack.nl
                  DNS:dhlretouropdracht.nl
                  DNS:dhlspeedpack.be
                  DNS:dhl-tracknet.nl
                  DNS:intraship-dhl.hu
                  DNS:servicepoint.se
                  DNS:umziehen.de
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                C8:03:02:DE:C0:B1:AB:83:C5:1E:FE:07:F7:78:BD:E5:83:04:88:7D
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6061F773354CD2ED5613A094AB0E8270D5C2479932B42DFDA727DB83FEBD18B8
    SPKI SHA256: 8307685F40CB2330F9F504FBA1817DA61ED315B755CA2BD2088D0F9FC3562367
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL TLS CA I3

- Subject: DPDHL TLS CA I3
- Issuer: Trusted Root CA G2
- Serial: -
- SHA-256: 01F8971121F4103D30BE4235CD7DC0EEE6C6AE12FCA7750848EA0E2E13FC2428
- SPKI SHA-256: -
- Validity: 2015-07-09 to 2020-07-09
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: false
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
No parsed certificate text available.
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- not_available

#### Computed Flags

- is_subordinate_ca
- is_expired

### DPDHL TLS CT CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS CT CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01EE5F171018063982B7FE8560
- SHA-256: 9153E4420DDC7EB4E6E864AA0377DADF4082ECD35052113638E05D3C296BC006
- SPKI SHA-256: C3EC7553398885FED61A951A269AB90C2DB18477502E6AAA858F283911DBE6E1
- Validity: 2018-09-19 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:17:10:18:06:39:82:b7:fe:85:60
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL TLS CT CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                28:98:23:24:25:20:F5:87:7D:0F:B2:4C:38:F2:3E:DC:35:C0:4E:94
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  DNS:adress-research.de
                  DNS:covis.de
                  DNS:deutschepost.com
                  DNS:deutschepost.de
                  DNS:dhl
                  DNS:dhl-delivernow.ch
                  DNS:dhl-delivernow.de
                  DNS:dhl-e-commerce.asia
                  DNS:dhl-ecommerce.asia
                  DNS:dhl-globalmail.com
                  DNS:dhl-usa.com
                  DNS:dhl.at
                  DNS:dhl.ca
                  DNS:dhl.ch
                  DNS:dhl.co.uk
                  DNS:dhl.com
                  DNS:dhl.com.hk
                  DNS:dhl.com.mx
                  DNS:dhl.com.pl
                  DNS:dhl.com.tr
                  DNS:dhl.cz
                  DNS:dhl.de
                  DNS:dhl.dk
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.fr
                  DNS:dhl.ie
                  DNS:dhl.it
                  DNS:dhl.lt
                  DNS:dhl.lv
                  DNS:dhl.nl
                  DNS:dhl.pl
                  DNS:dhl.ru
                  DNS:dhl.se
                  DNS:dhlbalik.sk
                  DNS:dhldomestic.co.uk
                  DNS:dhlecommerce-usa.com
                  DNS:dhlecommerce.asia
                  DNS:dhlecommerce.com
                  DNS:dhlexternal.com
                  DNS:dhlfreight.com
                  DNS:dhlglobalmail.com
                  DNS:dhlpaket.at
                  DNS:dhlpaket.de
                  DNS:dhlparcel.at
                  DNS:dhlparcel.be
                  DNS:dhlparcel.com
                  DNS:dhlparcel.com.cy
                  DNS:dhlparcel.com.mt
                  DNS:dhlparcel.cz
                  DNS:dhlparcel.de
                  DNS:dhlparcel.dk
                  DNS:dhlparcel.ee
                  DNS:dhlparcel.es
                  DNS:dhlparcel.eu
                  DNS:dhlparcel.fi
                  DNS:dhlparcel.fr
                  DNS:dhlparcel.gr
                  DNS:dhlparcel.hr
                  DNS:dhlparcel.hu
                  DNS:dhlparcel.ie
                  DNS:dhlparcel.info
                  DNS:dhlparcel.io
                  DNS:dhlparcel.it
                  DNS:dhlparcel.lt
                  DNS:dhlparcel.lu
                  DNS:dhlparcel.lv
                  DNS:dhlparcel.mobi
                  DNS:dhlparcel.net
                  DNS:dhlparcel.nl
                  DNS:dhlparcel.no
                  DNS:dhlparcel.org
                  DNS:dhlparcel.pl
                  DNS:dhlparcel.pt
                  DNS:dhlparcel.ro
                  DNS:dhlparcel.ru
                  DNS:dhlparcel.se
                  DNS:dhlparcel.si
                  DNS:dhlparcel.sk
                  DNS:dhlparcelshop.sk
                  DNS:dhlsameday.com
                  DNS:dhlservices.it
                  DNS:dp-dhl.com
                  DNS:dp-dhl.de
                  DNS:dp-dialog.de
                  DNS:dp-ds.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dpdhl.de
                  DNS:dpeps.de
                  DNS:dpihs.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnref.com
                  DNS:dpzahlungsdienste.de
                  DNS:efiliale.de
                  DNS:epost-dev.de
                  DNS:epost-gka.de
                  DNS:epost.de
                  DNS:exel.com
                  DNS:forumgelb.de
                  DNS:gerlach.cz
                  DNS:gerlachcs.com
                  DNS:mailingfactory.de
                  DNS:od-s.do
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:post.de
                  DNS:postdirekt.de
                  DNS:postpay.de
                  DNS:powerpackaging.com
                  DNS:ppl.cz
                  DNS:sims.me
                  DNS:standardforwarding.com
                  DNS:supplychain.nhs.uk
                  DNS:verongrauer.com
                  DNS:vetsch.net
                  DNS:williamslea.com
                  DNS:wlt.com
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9153E4420DDC7EB4E6E864AA0377DADF4082ECD35052113638E05D3C296BC006
    SPKI SHA256: C3EC7553398885FED61A951A269AB90C2DB18477502E6AAA858F283911DBE6E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL TLS SHA2 CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL TLS SHA2 CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E9D89F7BADBD843EA1B5D361
- SHA-256: 5A405535C112A0A81AF0D2ACCA3C3F9BC1A677586CDBC633CB4F5F778E1A3550
- SPKI SHA-256: F9F8050689B6BA606ADA9C3D230CAC4F4F9C81D903B2E7CBE4F5E26655349C41
- Validity: 2018-02-13 to 2023-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:7b:ad:bd:84:3e:a1:b5:d3:61
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2023 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL TLS SHA2 CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1C:2F:0F:4E:B9:BD:4E:89:5D:64:62:6E:DE:E0:A3:09:29:14:DB:1F
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  DNS:adac-postbus.de
                  DNS:adress-research.de
                  DNS:aerocar.nl
                  DNS:agent-dhl.com
                  DNS:airborne.com
                  DNS:allogis.com
                  DNS:allyouneedfresh.de
                  DNS:barclayscapitalcommunications.com
                  DNS:barclayscommunications.com
                  DNS:bigbuoytv.co.uk
                  DNS:bluedart.com
                  DNS:chilliworldwide.com
                  DNS:clear-mail.de
                  DNS:clixmix.de
                  DNS:consentric.de
                  DNS:contentconverter.de
                  DNS:covis.de
                  DNS:cpshop.de
                  DNS:delivernow.at
                  DNS:deliveryorder.co.uk
                  DNS:descorder.com
                  DNS:deutsche-sammlermuenzen.de
                  DNS:deutschepost.com
                  DNS:deutschepost.de
                  DNS:dhl
                  DNS:dhl-businessportal.com
                  DNS:dhl-corporate-wear.com
                  DNS:dhl-deliverit.com
                  DNS:dhl-delivernow.ch
                  DNS:dhl-delivernow.de
                  DNS:dhl-e-commerce.asia
                  DNS:dhl-ecommerce.asia
                  DNS:dhl-eship.nl
                  DNS:dhl-etrack.nl
                  DNS:dhl-geschaeftskundenportal.de
                  DNS:dhl-global-mail.nl
                  DNS:dhl-globalmail.ch
                  DNS:dhl-globalmail.com
                  DNS:dhl-globalmail.fr
                  DNS:dhl-globalmail.nl
                  DNS:dhl-internettrack.nl
                  DNS:dhl-promotional-items.com
                  DNS:dhl-tracknet.nl
                  DNS:dhl-usa.com
                  DNS:dhl-versandportal.de
                  DNS:dhl-webchecker.de
                  DNS:dhl.at
                  DNS:dhl.ca
                  DNS:dhl.ch
                  DNS:dhl.co.il
                  DNS:dhl.co.kr
                  DNS:dhl.co.uk
                  DNS:dhl.co.za
                  DNS:dhl.com
                  DNS:dhl.com.br
                  DNS:dhl.com.co
                  DNS:dhl.com.hk
                  DNS:dhl.com.mx
                  DNS:dhl.com.pl
                  DNS:dhl.com.sv
                  DNS:dhl.com.tr
                  DNS:dhl.cz
                  DNS:dhl.de
                  DNS:dhl.dk
                  DNS:dhl.ee
                  DNS:dhl.es
                  DNS:dhl.fr
                  DNS:dhl.ie
                  DNS:dhl.it
                  DNS:dhl.lt
                  DNS:dhl.lv
                  DNS:dhl.nl
                  DNS:dhl.pl
                  DNS:dhl.ru
                  DNS:dhl.se
                  DNS:dhl24.net
                  DNS:dhlactivity.com
                  DNS:dhlbalik.sk
                  DNS:dhlcloud.com.br
                  DNS:dhldashboard.se
                  DNS:dhldomestic.co.uk
                  DNS:dhleasydesk.nl
                  DNS:dhlecommerce-usa.com
                  DNS:dhlecommerce.asia
                  DNS:dhlecommerce.com
                  DNS:dhleuronetstatus.com
                  DNS:dhlexpress.nl
                  DNS:dhlexpresseasy.se
                  DNS:dhlexternal.com
                  DNS:dhlfreight.com
                  DNS:dhlfreight.dk
                  DNS:dhlfreight.ee
                  DNS:dhlfreight.fi
                  DNS:dhlfreight.lt
                  DNS:dhlfreight.lv
                  DNS:dhlfreight.no
                  DNS:dhlfreight.se
                  DNS:dhlglobalmail.co.uk
                  DNS:dhlglobalmail.com
                  DNS:dhloverflow.com
                  DNS:dhlpaket.at
                  DNS:dhlpaket.de
                  DNS:dhlparcel.at
                  DNS:dhlparcel.be
                  DNS:dhlparcel.com
                  DNS:dhlparcel.com.cy
                  DNS:dhlparcel.com.mt
                  DNS:dhlparcel.cz
                  DNS:dhlparcel.de
                  DNS:dhlparcel.dk
                  DNS:dhlparcel.ee
                  DNS:dhlparcel.es
                  DNS:dhlparcel.eu
                  DNS:dhlparcel.fi
                  DNS:dhlparcel.fr
                  DNS:dhlparcel.gr
                  DNS:dhlparcel.hr
                  DNS:dhlparcel.hu
                  DNS:dhlparcel.ie
                  DNS:dhlparcel.info
                  DNS:dhlparcel.io
                  DNS:dhlparcel.it
                  DNS:dhlparcel.lt
                  DNS:dhlparcel.lu
                  DNS:dhlparcel.lv
                  DNS:dhlparcel.mobi
                  DNS:dhlparcel.net
                  DNS:dhlparcel.nl
                  DNS:dhlparcel.no
                  DNS:dhlparcel.org
                  DNS:dhlparcel.pl
                  DNS:dhlparcel.pt
                  DNS:dhlparcel.ro
                  DNS:dhlparcel.ru
                  DNS:dhlparcel.se
                  DNS:dhlparcel.si
                  DNS:dhlparcel.sk
                  DNS:dhlparcelshop.sk
                  DNS:dhlretouropdracht.nl
                  DNS:dhlring.com
                  DNS:dhlsameday.com
                  DNS:dhlsameday.ie
                  DNS:dhlservicecenter.se
                  DNS:dhlservices.it
                  DNS:dhlstatus.com
                  DNS:dhltoolbox.se
                  DNS:dhltoolboxtest.se
                  DNS:dhltweb.com
                  DNS:die-redaktion.de
                  DNS:dieredaktion.de
                  DNS:direktmarketingcenter.de
                  DNS:docwallet.com
                  DNS:docwallet.de
                  DNS:dp-dhl-ic.com
                  DNS:dp-dhl.com
                  DNS:dp-dhl.de
                  DNS:dp-dialog.de
                  DNS:dp-ds.de
                  DNS:dp-itsolutions.de
                  DNS:dpcom.de
                  DNS:dpdhl.com
                  DNS:dpdhl.de
                  DNS:dpeps.de
                  DNS:dpfleet.com
                  DNS:dpfleet.de
                  DNS:dpihl.de
                  DNS:dpihs.de
                  DNS:dpwn.com
                  DNS:dpwn.de
                  DNS:dpwn.net
                  DNS:dpwnbc.net
                  DNS:dpwnref.com
                  DNS:dpzahlungsdienste.de
                  DNS:e-datagate.de
                  DNS:efiliale.de
                  DNS:einfacher-werben.de
                  DNS:einkaufaktuell.de
                  DNS:epost-dev.de
                  DNS:epost-gka.de
                  DNS:epost-gkausercontent.de
                  DNS:epost-solutions.de
                  DNS:epost.de
                  DNS:epostusercontent.de
                  DNS:epsotbriefe.biz
                  DNS:epsotbriefe.com
                  DNS:epsotbriefeusercontent.biz
                  DNS:epsotbriefeusercontent.com
                  DNS:exciting-challenges.com
                  DNS:exel.com
                  DNS:exelglobalusa.com
                  DNS:expresseasy.fi
                  DNS:expresseasy.se
                  DNS:fieldtrip.tv
                  DNS:forumgelb.de
                  DNS:fwlteam.com
                  DNS:gerlach.cz
                  DNS:gerlachcs.com
                  DNS:grusskarten-bestellen.de
                  DNS:infopost-manager.de
                  DNS:intraship-dhl.at
                  DNS:intraship-dhl.be
                  DNS:intraship-dhl.co.uk
                  DNS:intraship-dhl.cz
                  DNS:intraship-dhl.ee
                  DNS:intraship-dhl.fi
                  DNS:intraship-dhl.gr
                  DNS:intraship-dhl.hu
                  DNS:intraship-dhl.ie
                  DNS:intraship-dhl.it
                  DNS:intraship-dhl.lt
                  DNS:intraship-dhl.lu
                  DNS:intraship-dhl.lv
                  DNS:intraship-dhl.nl
                  DNS:intraship-dhl.si
                  DNS:intraship-dhl.sk
                  DNS:intraship-express.de
                  DNS:intraship.ch
                  DNS:intraship.de
                  DNS:laible.ch
                  DNS:landroverhub.com
                  DNS:leserservice-media.de
                  DNS:leserservice-sicherheitsabo.de
                  DNS:leserservice.de
                  DNS:lifeconex.com
                  DNS:live-billcentral.co.uk
                  DNS:mailingfactory.de
                  DNS:meinpaket.de
                  DNS:mister-h.com
                  DNS:mojadhl.sk
                  DNS:mojeppl.cz
                  DNS:mrsc.info
                  DNS:mydhl.it
                  DNS:mynextorder.co.uk
                  DNS:od-s.do
                  DNS:onlinefrankierung.de
                  DNS:packstation.de
                  DNS:paket.de
                  DNS:partnerportal-deutschepost.de
                  DNS:paysmart.de
                  DNS:portokalkulator.de
                  DNS:post-individuell.de
                  DNS:post-partner-shop.de
                  DNS:post.de
                  DNS:postadress.de
                  DNS:postbank-filialvertrieb.de
                  DNS:postbus.de
                  DNS:postdirekt.de
                  DNS:postofficeshop.de
                  DNS:postpay.de
                  DNS:powerpackaging.com
                  DNS:ppl.cz
                  DNS:pplbalik.cz
                  DNS:pplparcelshop.cz
                  DNS:premiumadress.de
                  DNS:premiumadresslabel.de
                  DNS:printcom.de
                  DNS:prospekt-service.de
                  DNS:prospektservice.de
                  DNS:rentenservice.com
                  DNS:rosterworldwide.com
                  DNS:saabdealergateway.com
                  DNS:sameday.ie
                  DNS:schreibcenter.de
                  DNS:selektvracht.nl
                  DNS:servicepoint.se
                  DNS:servicepointeuropa.se
                  DNS:servicepointinrikes.se
                  DNS:shop-onestop.com
                  DNS:simplydhl.com
                  DNS:sims.me
                  DNS:skycourier.com
                  DNS:smartsensor-temperature.net
                  DNS:smoke-mirrors.co.uk
                  DNS:smokeandmirrorsdesign.co.uk
                  DNS:standardforwarding.com
                  DNS:supplychain.nhs.uk
                  DNS:sv-institut.de
                  DNS:tag-response.co.uk
                  DNS:tagcreative.com
                  DNS:tageszeitung.de
                  DNS:tagworldwide.biz
                  DNS:tagworldwide.com
                  DNS:tasmancargo.net
                  DNS:thebox.us.com
                  DNS:thegazette.co.uk
                  DNS:theso.co.uk
                  DNS:tradeteam.com
                  DNS:triggerdialog.de
                  DNS:tso.co.uk
                  DNS:umziehen.de
                  DNS:umzugservice.com
                  DNS:van-swieten.com
                  DNS:verongrauer.com
                  DNS:vetsch.net
                  DNS:vgl.nl
                  DNS:williamslea.co.uk
                  DNS:williamslea.com
                  DNS:williamslea.net
                  DNS:williamsleatag.com
                  DNS:wlcis.net
                  DNS:wlt.com
                  DNS:worldservicecentre.com
                  DNS:worldwriters.com
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.60.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5A405535C112A0A81AF0D2ACCA3C3F9BC1A677586CDBC633CB4F5F778E1A3550
    SPKI SHA256: F9F8050689B6BA606ADA9C3D230CAC4F4F9C81D903B2E7CBE4F5E26655349C41
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.60.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL User CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL User CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 751E3F53784A32B3C2372FBEE3CB2707
- SHA-256: AF1898D7F0638751C075D0142D4E2A0EA731FC622324F153FE1BF3B6AFD9AF13
- SPKI SHA-256: 536E02FAD439FB1A995E326C8D698A9C0DCA0A4C7CE3104D48FCD50B3A64A3F0
- Validity: 2019-06-19 to 2020-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.agent-dhl.com","email:.bluedart.com","email:.connect-logistics.com","email:.deutschepost.com","email:.deutschepost.de","email:.dhl.com","email:.dhl.de","email:.dhl.ru","email:.dp-dhl.com","email:.dp-ds.de","email:.dpcsc.de","email:.dpdhl-brands.com","email:.dpdhl.com","email:.dpihs.de","email:.dpwn.com","email:.dpwn.de","email:.exel.com","email:.exelglobalusa.com","email:.ezylcl.com","email:.gerlach.cz","email:.gerlachcs.com","email:.laible.ch","email:.lifeconex.com","email:.mytalentworld.net","email:.packstation.de","email:.postadress.de","email:.postdirekt.de","email:.powerpackaging.com","email:.ppl.cz","email:.sims.me","email:.standardforwarding.com","email:.supplychain.nhs.uk","email:.tasmancargo.com","email:.tasmancargo.net","email:.van-swieten.com","email:.verongrauer.com","email:.vetsch.net","email:agent-dhl.com","email:bluedart.com","email:connect-logistics.com","email:deutschepost.com","email:deutschepost.de","email:dhl.com","email:dhl.de","email:dhl.ru","email:dp-dhl.com","email:dp-ds.de","email:dpcsc.de","email:dpdhl-brands.com","email:dpdhl.com","email:dpihs.de","email:dpwn.com","email:dpwn.de","email:exel.com","email:exelglobalusa.com","email:ezylcl.com","email:gerlach.cz","email:gerlachcs.com","email:laible.ch","email:lifeconex.com","email:mytalentworld.net","email:packstation.de","email:postadress.de","email:postdirekt.de","email:powerpackaging.com","email:ppl.cz","email:sims.me","email:standardforwarding.com","email:supplychain.nhs.uk","email:tasmancargo.com","email:tasmancargo.net","email:van-swieten.com","email:verongrauer.com","email:vetsch.net"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:53:78:4a:32:b3:c2:37:2f:be:e3:cb:27:07
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Jun 19 00:00:00 2019 GMT
            Not After : Jul 31 23:00:00 2020 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL User CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7F:FB:70:72:98:10:C6:C9:1F:84:10:DE:8F:08:A5:67:93:8E:5C:33
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.agent-dhl.com
                  email:.bluedart.com
                  email:.connect-logistics.com
                  email:.deutschepost.com
                  email:.deutschepost.de
                  email:.dhl.com
                  email:.dhl.de
                  email:.dhl.ru
                  email:.dp-dhl.com
                  email:.dp-ds.de
                  email:.dpcsc.de
                  email:.dpdhl-brands.com
                  email:.dpdhl.com
                  email:.dpihs.de
                  email:.dpwn.com
                  email:.dpwn.de
                  email:.exel.com
                  email:.exelglobalusa.com
                  email:.ezylcl.com
                  email:.gerlach.cz
                  email:.gerlachcs.com
                  email:.laible.ch
                  email:.lifeconex.com
                  email:.mytalentworld.net
                  email:.packstation.de
                  email:.postadress.de
                  email:.postdirekt.de
                  email:.powerpackaging.com
                  email:.ppl.cz
                  email:.sims.me
                  email:.standardforwarding.com
                  email:.supplychain.nhs.uk
                  email:.tasmancargo.com
                  email:.tasmancargo.net
                  email:.van-swieten.com
                  email:.verongrauer.com
                  email:.vetsch.net
                  email:agent-dhl.com
                  email:bluedart.com
                  email:connect-logistics.com
                  email:deutschepost.com
                  email:deutschepost.de
                  email:dhl.com
                  email:dhl.de
                  email:dhl.ru
                  email:dp-dhl.com
                  email:dp-ds.de
                  email:dpcsc.de
                  email:dpdhl-brands.com
                  email:dpdhl.com
                  email:dpihs.de
                  email:dpwn.com
                  email:dpwn.de
                  email:exel.com
                  email:exelglobalusa.com
                  email:ezylcl.com
                  email:gerlach.cz
                  email:gerlachcs.com
                  email:laible.ch
                  email:lifeconex.com
                  email:mytalentworld.net
                  email:packstation.de
                  email:postadress.de
                  email:postdirekt.de
                  email:powerpackaging.com
                  email:ppl.cz
                  email:sims.me
                  email:standardforwarding.com
                  email:supplychain.nhs.uk
                  email:tasmancargo.com
                  email:tasmancargo.net
                  email:van-swieten.com
                  email:verongrauer.com
                  email:vetsch.net
                  DNS:dhl.com
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                  DirName:DC = com, DC = dhl
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5064.1.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AF1898D7F0638751C075D0142D4E2A0EA731FC622324F153FE1BF3B6AFD9AF13
    SPKI SHA256: 536E02FAD439FB1A995E326C8D698A9C0DCA0A4C7CE3104D48FCD50B3A64A3F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.agent-dhl.com","email:.bluedart.com","email:.connect-logistics.com","email:.deutschepost.com","email:.deutschepost.de","email:.dhl.com","email:.dhl.de","email:.dhl.ru","email:.dp-dhl.com","email:.dp-ds.de","email:.dpcsc.de","email:.dpdhl-brands.com","email:.dpdhl.com","email:.dpihs.de","email:.dpwn.com","email:.dpwn.de","email:.exel.com","email:.exelglobalusa.com","email:.ezylcl.com","email:.gerlach.cz","email:.gerlachcs.com","email:.laible.ch","email:.lifeconex.com","email:.mytalentworld.net","email:.packstation.de","email:.postadress.de","email:.postdirekt.de","email:.powerpackaging.com","email:.ppl.cz","email:.sims.me","email:.standardforwarding.com","email:.supplychain.nhs.uk","email:.tasmancargo.com","email:.tasmancargo.net","email:.van-swieten.com","email:.verongrauer.com","email:.vetsch.net","email:agent-dhl.com","email:bluedart.com","email:connect-logistics.com","email:deutschepost.com","email:deutschepost.de","email:dhl.com","email:dhl.de","email:dhl.ru","email:dp-dhl.com","email:dp-ds.de","email:dpcsc.de","email:dpdhl-brands.com","email:dpdhl.com","email:dpihs.de","email:dpwn.com","email:dpwn.de","email:exel.com","email:exelglobalusa.com","email:ezylcl.com","email:gerlach.cz","email:gerlachcs.com","email:laible.ch","email:lifeconex.com","email:mytalentworld.net","email:packstation.de","email:postadress.de","email:postdirekt.de","email:powerpackaging.com","email:ppl.cz","email:sims.me","email:standardforwarding.com","email:supplychain.nhs.uk","email:tasmancargo.com","email:tasmancargo.net","email:van-swieten.com","email:verongrauer.com","email:vetsch.net"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL User CA I3

- Subject: countryName=DE, stateOrProvinceName=Nordrhein-Westfalen, localityName=Bonn, organizationName=Deutsche Post, commonName=DPDHL User CA I3
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E9D89F8BB87CBF1982CB3EF0
- SHA-256: F037621405E0F356507E239FADD647842D3B50857C3CFF840859174F72F6FD18
- SPKI SHA-256: 536E02FAD439FB1A995E326C8D698A9C0DCA0A4C7CE3104D48FCD50B3A64A3F0
- Validity: 2018-02-13 to 2023-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.aerocar.nl","email:.agent-dhl.com","email:.bigbuoytv.co.uk","email:.bluedart.com","email:.deutschepost.com","email:.deutschepost.de","email:.dhl.com","email:.dhl.de","email:.dhl.ru","email:.dp-dhl.com","email:.dp-ds.de","email:.dpdhl.com","email:.dpihs.de","email:.dpwn.com","email:.dpwn.de","email:.exel.com","email:.exelglobalusa.com","email:.gerlach.cz","email:.gerlachcs.com","email:.laible.ch","email:.lifeconex.com","email:.packstation.de","email:.postadress.de","email:.postbank-filialvertrieb.de","email:.postbus.de","email:.postdirekt.de","email:.powerpackaging.com","email:.ppl.cz","email:.shop-onestop.com","email:.smoke-mirrors.co.uk","email:.standardforwarding.com","email:.supplychain.nhs.uk","email:.sv-institut.de","email:.tagworldwide.com","email:.tasmancargo.net","email:.tradeteam.com","email:.tso.co.uk","email:.van-swieten.com","email:.verongrauer.com","email:.vetsch.net","email:.williamslea.com","email:.wlt.com","email:.worldwriters.com","email:aerocar.nl","email:agent-dhl.com","email:bigbuoytv.co.uk","email:bluedart.com","email:deutschepost.com","email:deutschepost.de","email:dhl.com","email:dhl.de","email:dhl.ru","email:dp-dhl.com","email:dp-ds.de","email:dpdhl.com","email:dpihs.de","email:dpwn.com","email:dpwn.de","email:exel.com","email:exelglobalusa.com","email:gerlach.cz","email:gerlachcs.com","email:laible.ch","email:lifeconex.com","email:packstation.de","email:postadress.de","email:postbank-filialvertrieb.de","email:postbus.de","email:postdirekt.de","email:powerpackaging.com","email:ppl.cz","email:shop-onestop.com","email:smoke-mirrors.co.uk","email:standardforwarding.com","email:supplychain.nhs.uk","email:sv-institut.de","email:tagworldwide.com","email:tasmancargo.net","email:tradeteam.com","email:tso.co.uk","email:van-swieten.com","email:verongrauer.com","email:vetsch.net","email:williamslea.com","email:wlt.com","email:worldwriters.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:8b:b8:7c:bf:19:82:cb:3e:f0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2023 GMT
        Subject: C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post, CN = DPDHL User CA I3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7F:FB:70:72:98:10:C6:C9:1F:84:10:DE:8F:08:A5:67:93:8E:5C:33
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.aerocar.nl
                  email:.agent-dhl.com
                  email:.bigbuoytv.co.uk
                  email:.bluedart.com
                  email:.deutschepost.com
                  email:.deutschepost.de
                  email:.dhl.com
                  email:.dhl.de
                  email:.dhl.ru
                  email:.dp-dhl.com
                  email:.dp-ds.de
                  email:.dpdhl.com
                  email:.dpihs.de
                  email:.dpwn.com
                  email:.dpwn.de
                  email:.exel.com
                  email:.exelglobalusa.com
                  email:.gerlach.cz
                  email:.gerlachcs.com
                  email:.laible.ch
                  email:.lifeconex.com
                  email:.packstation.de
                  email:.postadress.de
                  email:.postbank-filialvertrieb.de
                  email:.postbus.de
                  email:.postdirekt.de
                  email:.powerpackaging.com
                  email:.ppl.cz
                  email:.shop-onestop.com
                  email:.smoke-mirrors.co.uk
                  email:.standardforwarding.com
                  email:.supplychain.nhs.uk
                  email:.sv-institut.de
                  email:.tagworldwide.com
                  email:.tasmancargo.net
                  email:.tradeteam.com
                  email:.tso.co.uk
                  email:.van-swieten.com
                  email:.verongrauer.com
                  email:.vetsch.net
                  email:.williamslea.com
                  email:.wlt.com
                  email:.worldwriters.com
                  email:aerocar.nl
                  email:agent-dhl.com
                  email:bigbuoytv.co.uk
                  email:bluedart.com
                  email:deutschepost.com
                  email:deutschepost.de
                  email:dhl.com
                  email:dhl.de
                  email:dhl.ru
                  email:dp-dhl.com
                  email:dp-ds.de
                  email:dpdhl.com
                  email:dpihs.de
                  email:dpwn.com
                  email:dpwn.de
                  email:exel.com
                  email:exelglobalusa.com
                  email:gerlach.cz
                  email:gerlachcs.com
                  email:laible.ch
                  email:lifeconex.com
                  email:packstation.de
                  email:postadress.de
                  email:postbank-filialvertrieb.de
                  email:postbus.de
                  email:postdirekt.de
                  email:powerpackaging.com
                  email:ppl.cz
                  email:shop-onestop.com
                  email:smoke-mirrors.co.uk
                  email:standardforwarding.com
                  email:supplychain.nhs.uk
                  email:sv-institut.de
                  email:tagworldwide.com
                  email:tasmancargo.net
                  email:tradeteam.com
                  email:tso.co.uk
                  email:van-swieten.com
                  email:verongrauer.com
                  email:vetsch.net
                  email:williamslea.com
                  email:wlt.com
                  email:worldwriters.com
                  DNS:dhl.com
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post AG
                  DirName:C = DE, ST = Nordrhein-Westfalen, L = Bonn, O = Deutsche Post
                  DirName:DC = com, DC = dhl
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5064.1.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F037621405E0F356507E239FADD647842D3B50857C3CFF840859174F72F6FD18
    SPKI SHA256: 536E02FAD439FB1A995E326C8D698A9C0DCA0A4C7CE3104D48FCD50B3A64A3F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.5064.1.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.aerocar.nl","email:.agent-dhl.com","email:.bigbuoytv.co.uk","email:.bluedart.com","email:.deutschepost.com","email:.deutschepost.de","email:.dhl.com","email:.dhl.de","email:.dhl.ru","email:.dp-dhl.com","email:.dp-ds.de","email:.dpdhl.com","email:.dpihs.de","email:.dpwn.com","email:.dpwn.de","email:.exel.com","email:.exelglobalusa.com","email:.gerlach.cz","email:.gerlachcs.com","email:.laible.ch","email:.lifeconex.com","email:.packstation.de","email:.postadress.de","email:.postbank-filialvertrieb.de","email:.postbus.de","email:.postdirekt.de","email:.powerpackaging.com","email:.ppl.cz","email:.shop-onestop.com","email:.smoke-mirrors.co.uk","email:.standardforwarding.com","email:.supplychain.nhs.uk","email:.sv-institut.de","email:.tagworldwide.com","email:.tasmancargo.net","email:.tradeteam.com","email:.tso.co.uk","email:.van-swieten.com","email:.verongrauer.com","email:.vetsch.net","email:.williamslea.com","email:.wlt.com","email:.worldwriters.com","email:aerocar.nl","email:agent-dhl.com","email:bigbuoytv.co.uk","email:bluedart.com","email:deutschepost.com","email:deutschepost.de","email:dhl.com","email:dhl.de","email:dhl.ru","email:dp-dhl.com","email:dp-ds.de","email:dpdhl.com","email:dpihs.de","email:dpwn.com","email:dpwn.de","email:exel.com","email:exelglobalusa.com","email:gerlach.cz","email:gerlachcs.com","email:laible.ch","email:lifeconex.com","email:packstation.de","email:postadress.de","email:postbank-filialvertrieb.de","email:postbus.de","email:postdirekt.de","email:powerpackaging.com","email:ppl.cz","email:shop-onestop.com","email:smoke-mirrors.co.uk","email:standardforwarding.com","email:supplychain.nhs.uk","email:sv-institut.de","email:tagworldwide.com","email:tasmancargo.net","email:tradeteam.com","email:tso.co.uk","email:van-swieten.com","email:verongrauer.com","email:vetsch.net","email:williamslea.com","email:wlt.com","email:worldwriters.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### DPDHL User CA I4

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE09891E46FB0FD754E744CCF428
- SHA-256: C25C4EDBC36E3FB7C3D937BEE9F2D29E36AFB07CFA3188262E0D5FDC919E0D77
- SPKI SHA-256: 39636E57A56DA26FD3976D6EEFA22D11989F366505AB293C6C8761A9361BA34A
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:09:89:1e:46:fb:0f:d7:54:e7:44:cc:f4:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DPDHL User CA I4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                61:9D:20:94:52:CD:34:AA:CB:53:11:FB:0B:F5:22:F5:D5:BD:4E:4C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C25C4EDBC36E3FB7C3D937BEE9F2D29E36AFB07CFA3188262E0D5FDC919E0D77
    SPKI SHA256: 39636E57A56DA26FD3976D6EEFA22D11989F366505AB293C6C8761A9361BA34A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### DPDHL User CA I5

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 811404120A4DA170F12A9DFA62FC007D
- SHA-256: D4422292BB7DA8F8808DFA315D16A3A1380DB929E1E5A0335128FA71419E92BE
- SPKI SHA-256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
- Validity: 2024-05-15 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlusercai5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:12:0a:4d:a1:70:f1:2a:9d:fa:62:fc:00:7d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 03:23:19 2024 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DPDHL User CA I5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:B4:0F:1B:07:DC:7F:7E:0E:E0:02:DA:D4:56:52:0E:46:9C:C9:27
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D4422292BB7DA8F8808DFA315D16A3A1380DB929E1E5A0335128FA71419E92BE
    SPKI SHA256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DPDHL User CA I5

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC37760DAAF2B8605F6CCF43FC7D7F
- SHA-256: 487A1BBFE1106CF575F04196CAE3D987D990A29640F4CA5C8994830131541DA1
- SPKI SHA-256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlusercai5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:76:0d:aa:f2:b8:60:5f:6c:cf:43:fc:7d:7f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:31:51 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DPDHL User CA I5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:B4:0F:1B:07:DC:7F:7E:0E:E0:02:DA:D4:56:52:0E:46:9C:C9:27
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.1
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 487A1BBFE1106CF575F04196CAE3D987D990A29640F4CA5C8994830131541DA1
    SPKI SHA256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DPDHL User CA I5

- Subject: countryName=DE, organizationName=Deutsche Post AG, commonName=DPDHL User CA I5
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803185866A47FFBC70270704CDE87FF
- SHA-256: 163B5F69720164075C16CE760A93C85D5073CD5A0D41C7A3AFB0B5E75B3DC646
- SPKI SHA-256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/dhlusercai5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:58:66:a4:7f:fb:c7:02:70:70:4c:de:87:ff
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = Deutsche Post AG, CN = DPDHL User CA I5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:B4:0F:1B:07:DC:7F:7E:0E:E0:02:DA:D4:56:52:0E:46:9C:C9:27
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 163B5F69720164075C16CE760A93C85D5073CD5A0D41C7A3AFB0B5E75B3DC646
    SPKI SHA256: 972071578DCA1D709447F8957CC8C116551D90B6F195649D42430FDA2EE98BC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DSigner GCC R3 SMIME CA 2020

- Subject: countryName=GT, organizationName=DSIGNER, SOCIEDAD ANÓNIMA, commonName=DSigner GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA120BB6B7CA24C32D75EFB8E4AE
- SHA-256: 3FA4A9B65FDF6876FE668DFECC434932EBC254FD741119FC432A5989A085F320
- SPKI SHA-256: B617202520087538C794343A89113312BAB9946F5B731CFB01D4AB88ADF48EB5
- Validity: 2020-10-21 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/dsignergccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:12:0b:b6:b7:ca:24:c3:2d:75:ef:b8:e4:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 21 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = GT, O = "DSIGNER, SOCIEDAD AN\C3\93NIMA", CN = DSigner GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:F3:A5:66:BF:20:4E:16:92:4E:51:EF:2D:F3:F9:58:54:51:85:96
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3FA4A9B65FDF6876FE668DFECC434932EBC254FD741119FC432A5989A085F320
    SPKI SHA256: B617202520087538C794343A89113312BAB9946F5B731CFB01D4AB88ADF48EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DSigner GCC R3 SMIME CA 2020

- Subject: countryName=GT, organizationName=DSIGNER, SOCIEDAD ANÓNIMA, commonName=DSigner GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC372C7086760AD3DE02E5009137F4
- SHA-256: 0E95B3411E3806ECF7C4C6026956F3E5F3EB1EC096C0F982CAD30ECB37AFFC85
- SPKI SHA-256: B617202520087538C794343A89113312BAB9946F5B731CFB01D4AB88ADF48EB5
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/dsignergccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:2c:70:86:76:0a:d3:de:02:e5:00:91:37:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:30:53 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = GT, O = "DSIGNER, SOCIEDAD AN\C3\93NIMA", CN = DSigner GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:F3:A5:66:BF:20:4E:16:92:4E:51:EF:2D:F3:F9:58:54:51:85:96
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0E95B3411E3806ECF7C4C6026956F3E5F3EB1EC096C0F982CAD30ECB37AFFC85
    SPKI SHA256: B617202520087538C794343A89113312BAB9946F5B731CFB01D4AB88ADF48EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EmblemHealth SHA256 CA - G3

- Subject: countryName=US, stateOrProvinceName=New York, organizationName=EmblemHealth, Inc., commonName=EmblemHealth SHA256 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 4844DCC6295799E63237FD924D3B
- SHA-256: 4A1144E6B2B1E3E2B934587B07421D14AF3B2F7F79254FB02D0AD3FE67D79027
- SPKI SHA-256: 24F5696AC60F2FE8A2A90B500444B697A52C353442C6BD1AE7D7F5E089576DC2
- Validity: 2016-07-20 to 2021-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:44:dc:c6:29:57:99:e6:32:37:fd:92:4d:3b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jul 20 00:00:00 2016 GMT
            Not After : Jul 20 00:00:00 2021 GMT
        Subject: C = US, ST = New York, O = "EmblemHealth, Inc.", CN = EmblemHealth SHA256 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9E:A3:21:6F:EE:2C:81:E9:88:3B:EF:2A:29:24:7D:01:DF:36:BA:8E
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4A1144E6B2B1E3E2B934587B07421D14AF3B2F7F79254FB02D0AD3FE67D79027
    SPKI SHA256: 24F5696AC60F2FE8A2A90B500444B697A52C353442C6BD1AE7D7F5E089576DC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### European GNSS Agency Atlas R45 SMIME CA 2021

- Subject: countryName=CZ, organizationName=European GNSS Agency (GSA), commonName=European GNSS Agency Atlas R45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 79299AB440A6BA13CE43749AEAE93E68
- SHA-256: F4EFE27C6B037747B3A89E23EE23C1B70A24DEB53B2E02F423BB0F73E1822267
- SPKI SHA-256: DBD6D104B17F77C17F8288467CA5DEF98C4EB0A72C618DBEB9687BA8E559EB35
- Validity: 2021-02-24 to 2028-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/europeangnssagencyatlasr45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9a:b4:40:a6:ba:13:ce:43:74:9a:ea:e9:3e:68
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Feb 24 00:00:00 2021 GMT
            Not After : Feb 24 00:00:00 2028 GMT
        Subject: C = CZ, O = European GNSS Agency (GSA), CN = European GNSS Agency Atlas R45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2B:27:99:8F:53:E2:34:48:37:A8:8B:F4:73:E2:F4:5C:4D:1B:93:23
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F4EFE27C6B037747B3A89E23EE23C1B70A24DEB53B2E02F423BB0F73E1822267
    SPKI SHA256: DBD6D104B17F77C17F8288467CA5DEF98C4EB0A72C618DBEB9687BA8E559EB35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### European Labour Authority Atlas R45 SMIME CA 2024

- Subject: countryName=SK, organizationName=European Labour Authority, commonName=European Labour Authority Atlas R45 SMIME CA 2024
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8214419280D4AD04930D3A1BCE744521
- SHA-256: 04A63C051A207C4D88CACF0451412204CC759CA0584DE1EA3D5C658D3AF4F03C
- SPKI SHA-256: 2CB7DB7B1405EA8F6478957072FE003C4489767A13FACD0826B36663D3E239AC
- Validity: 2024-10-16 to 2034-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/elaatlasr45smimeca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:92:80:d4:ad:04:93:0d:3a:1b:ce:74:45:21
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Oct 16 03:09:13 2024 GMT
            Not After : Oct 16 00:00:00 2034 GMT
        Subject: C = SK, O = European Labour Authority, CN = European Labour Authority Atlas R45 SMIME CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EF:17:53:AF:AA:E9:34:DF:A7:2A:7E:16:B4:36:41:5C:2A:B9:8B:AB
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 04A63C051A207C4D88CACF0451412204CC759CA0584DE1EA3D5C658D3AF4F03C
    SPKI SHA256: 2CB7DB7B1405EA8F6478957072FE003C4489767A13FACD0826B36663D3E239AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EUSPA AR45 SMIME CA 2021

- Subject: countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7A925C0BAA9CD1B5CCA9286854D94C93
- SHA-256: A2F5C0CD7364E1123B21556FB7999BEA8E9F0AEF399A3544CD12EB83C238BA1E
- SPKI SHA-256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
- Validity: 2021-08-18 to 2028-08-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/euspaar45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:92:5c:0b:aa:9c:d1:b5:cc:a9:28:68:54:d9:4c:93
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Aug 18 12:00:00 2021 GMT
            Not After : Aug 18 00:00:00 2028 GMT
        Subject: C = CZ, O = European Union Agency for the Space Programme (EUSPA), CN = EUSPA AR45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                53:72:30:E0:25:4A:45:7F:53:3E:A5:4E:8E:40:76:6A:69:71:D7:90
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A2F5C0CD7364E1123B21556FB7999BEA8E9F0AEF399A3544CD12EB83C238BA1E
    SPKI SHA256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EUSPA AR45 SMIME CA 2021

- Subject: countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC373F567D36CAE8F8CA5DAF2E2FA2
- SHA-256: 9506357B3B18E56BAEEBE95B7B9CB873A7C8AC973239DAA4D0BCEAAFFC527404
- SPKI SHA-256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
- Validity: 2023-06-28 to 2028-08-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/euspaar45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:3f:56:7d:36:ca:e8:f8:ca:5d:af:2e:2f:a2
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:08 2023 GMT
            Not After : Aug 18 00:00:00 2028 GMT
        Subject: C = CZ, O = European Union Agency for the Space Programme (EUSPA), CN = EUSPA AR45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                53:72:30:E0:25:4A:45:7F:53:3E:A5:4E:8E:40:76:6A:69:71:D7:90
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9506357B3B18E56BAEEBE95B7B9CB873A7C8AC973239DAA4D0BCEAAFFC527404
    SPKI SHA256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EUSPA AR45 SMIME CA 2021

- Subject: countryName=CZ, organizationName=European Union Agency for the Space Programme (EUSPA), commonName=EUSPA AR45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8114042CABFA811D1D52B3B7E28CF49B
- SHA-256: 4B2757399C7DDCBFFCD1CEE17390D92958E6D95838105E8FF52205A6CE917F51
- SPKI SHA-256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
- Validity: 2024-05-15 to 2028-08-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/euspaar45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:2c:ab:fa:81:1d:1d:52:b3:b7:e2:8c:f4:9b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: May 15 03:23:40 2024 GMT
            Not After : Aug 18 00:00:00 2028 GMT
        Subject: C = CZ, O = European Union Agency for the Space Programme (EUSPA), CN = EUSPA AR45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                53:72:30:E0:25:4A:45:7F:53:3E:A5:4E:8E:40:76:6A:69:71:D7:90
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4B2757399C7DDCBFFCD1CEE17390D92958E6D95838105E8FF52205A6CE917F51
    SPKI SHA256: 481ED710F409A9730323F0F28819CADD40A4EA7864A609E14B85FA7DF0212554
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EY LLP GCC R3 SMIME CA 2020

- Subject: countryName=GB, organizationName=Ernst & Young LLP, commonName=EY LLP GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031AA0EBB5D32DD5BE322DBB75569B
- SHA-256: 3A093122808FFFA440E19824D0BC7CD6B01D8D8277F7F42FA16E80A0205D4A7A
- SPKI SHA-256: 1AC95F1766E7194847B388EC2985F6091FC5A9FAECDA38345A5D4BD628E94C1E
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/eyllpgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:a0:eb:b5:d3:2d:d5:be:32:2d:bb:75:56:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = GB, O = Ernst & Young LLP, CN = EY LLP GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                57:62:BD:68:94:69:37:1C:06:EC:D3:3E:8C:D0:B7:F7:28:2B:DB:8B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3A093122808FFFA440E19824D0BC7CD6B01D8D8277F7F42FA16E80A0205D4A7A
    SPKI SHA256: 1AC95F1766E7194847B388EC2985F6091FC5A9FAECDA38345A5D4BD628E94C1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EY LLP SHA256 CA - G2

- Subject: countryName=GB, organizationName=Ernst & Young LLP, commonName=EY LLP SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01EE5F22DB57B6C9E80F67F97C
- SHA-256: 1557F65BA61C958B74EFA4A582BBAEBDD62A6D9B65FE95A80D5ED518F46ED87F
- SPKI SHA-256: 85DD884EAB42C8CCBCAA487BA39273DDC4740C0166C5A929BF659B1165897B95
- Validity: 2018-11-21 to 2023-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:db:57:b6:c9:e8:0f:67:f9:7c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2023 GMT
        Subject: C = GB, O = Ernst & Young LLP, CN = EY LLP SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F1:4E:D7:FC:D0:85:E9:8C:70:74:73:F5:EB:05:66:58:AE:19:EB:90
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1557F65BA61C958B74EFA4A582BBAEBDD62A6D9B65FE95A80D5ED518F46ED87F
    SPKI SHA256: 85DD884EAB42C8CCBCAA487BA39273DDC4740C0166C5A929BF659B1165897B95
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### FIFCO Atlas R45 SMIME CA 2020

- Subject: countryName=CR, organizationName=FIFCO, commonName=FIFCO Atlas R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 78031863C322C002AA6C2642E0318D94
- SHA-256: 80642AAC7C782BCDB0C3F6F385488F9BE3BB2DE30B863009E74B29F026C9EAE6
- SPKI SHA-256: D1A8E507A96366C6D63D849E0D101C27C391973994B9A01C741699C8A6518844
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/fifcoatlasr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:63:c3:22:c0:02:aa:6c:26:42:e0:31:8d:94
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = CR, O = FIFCO, CN = FIFCO Atlas R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8F:F2:B7:DB:DE:83:81:AD:83:DD:28:49:50:D9:0B:49:48:D5:51:E8
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 80642AAC7C782BCDB0C3F6F385488F9BE3BB2DE30B863009E74B29F026C9EAE6
    SPKI SHA256: D1A8E507A96366C6D63D849E0D101C27C391973994B9A01C741699C8A6518844
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ford Motor Company - Enterprise CA

- Subject: commonName=Ford Motor Company - Enterprise CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000116AA006682
- SHA-256: 538328B0460BAC889511AAB01498BD5FFDB9FA6ED2C9437672616EAB5198CF89
- SPKI SHA-256: C24CF3AD5000F86C9FF5F2A0592EFCCE2094C2CD693F65DD0DF85C9B9EEF0901
- Validity: 2007-12-05 to 2017-12-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:16:aa:00:66:82
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec  5 11:00:00 2007 GMT
            Not After : Dec  5 11:00:00 2017 GMT
        Subject: CN = Ford Motor Company - Enterprise CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9F:15:7B:28:C4:5C:D2:54:B4:85:6B:3F:1D:5E:22:07:8F:88:D4:26
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 538328B0460BAC889511AAB01498BD5FFDB9FA6ED2C9437672616EAB5198CF89
    SPKI SHA256: C24CF3AD5000F86C9FF5F2A0592EFCCE2094C2CD693F65DD0DF85C9B9EEF0901
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Ford Motor Company - Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E528B46BFD2B89A9BCBCD6C7
- SHA-256: 3B9668F59F55FA3838FC2A3B80B7F9B5B13D1A46F1EAA6E0BCFF04C54198056C
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2017-09-20 to 2022-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b4:6b:fd:2b:89:a9:bc:bc:d6:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 20 00:00:00 2017 GMT
            Not After : Sep 20 00:00:00 2022 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company - Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.ach-llc2.com
                  email:.cotarko.com
                  email:.european-llp.com
                  email:.ford-alliance.com
                  email:.ford.com
                  email:.fordcredit.com
                  email:.forsonordic.com
                  email:.lincoln.com
                  email:.lincolnafs.com
                  email:ach-llc2.com
                  email:cotarko.com
                  email:european-llp.com
                  email:ford-alliance.com
                  email:ford.com
                  email:fordcredit.com
                  email:forsonordic.com
                  email:lincoln.com
                  email:lincolnafs.com
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B9668F59F55FA3838FC2A3B80B7F9B5B13D1A46F1EAA6E0BCFF04C54198056C
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ford Motor Company - Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 4655F473E5C143FFB66D9EFCAA2E
- SHA-256: 719306D8FE2D9AB7BD17D5E211E439E50CE35B471F038B7E89BA098FFA5F2427
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2015-03-26 to 2020-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:55:f4:73:e5:c1:43:ff:b6:6d:9e:fc:aa:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Mar 26 00:00:00 2015 GMT
            Not After : Mar 26 00:00:00 2020 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company - Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.ach-llc2.com
                  email:.cotarko.com
                  email:.european-llp.com
                  email:.first-aquitaine.com
                  email:.fmcc.ch
                  email:.ford-alliance.com
                  email:.ford.com
                  email:.fordcredit.com
                  email:.forsonordic.com
                  email:.lincoln.com
                  email:.lincolnafs.com
                  email:.troydm.com
                  email:.volvoautobank.de
                  email:ach-llc2.com
                  email:cotarko.com
                  email:european-llp.com
                  email:first-aquitaine.com
                  email:fmcc.ch
                  email:ford-alliance.com
                  email:ford.com
                  email:fordcredit.com
                  email:forsonordic.com
                  email:lincoln.com
                  email:lincolnafs.com
                  email:troydm.com
                  email:volvoautobank.de
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1

                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 719306D8FE2D9AB7BD17D5E211E439E50CE35B471F038B7E89BA098FFA5F2427
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ford Motor Company - Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 47C310547663603FFC2EA1ABA1BF
- SHA-256: CF73B52D041B7309B439D16247414B90C9D26E44E38748A36500D5829B5187F9
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2016-04-20 to 2020-09-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:10:54:76:63:60:3f:fc:2e:a1:ab:a1:bf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Apr 20 00:00:00 2016 GMT
            Not After : Sep 16 00:00:00 2020 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company - Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF73B52D041B7309B439D16247414B90C9D26E44E38748A36500D5829B5187F9
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ford Motor Company - Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 4707B107950409CD75FD9D5AEA98
- SHA-256: 4C241CFE3D3FFB60CA88D6B06A552AB1CF0EF7D8D2E08DA15282B55192EBBD29
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2015-09-16 to 2020-09-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:07:b1:07:95:04:09:cd:75:fd:9d:5a:ea:98
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 16 00:00:00 2015 GMT
            Not After : Sep 16 00:00:00 2020 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company - Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.ach-llc2.com
                  email:.cotarko.com
                  email:.european-llp.com
                  email:.first-aquitaine.com
                  email:.fmcc.ch
                  email:.ford-alliance.com
                  email:.ford.com
                  email:.fordcredit.com
                  email:.forsonordic.com
                  email:.lincoln.com
                  email:.lincolnafs.com
                  email:.troydm.com
                  email:.volvoautobank.de
                  email:ach-llc2.com
                  email:cotarko.com
                  email:european-llp.com
                  email:first-aquitaine.com
                  email:fmcc.ch
                  email:ford-alliance.com
                  email:ford.com
                  email:fordcredit.com
                  email:forsonordic.com
                  email:lincoln.com
                  email:lincolnafs.com
                  email:troydm.com
                  email:volvoautobank.de
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4C241CFE3D3FFB60CA88D6B06A552AB1CF0EF7D8D2E08DA15282B55192EBBD29
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ford Motor Company - Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company - Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E707D1D76D17BF8AE1C61089
- SHA-256: 3802E424516F78EEAC329AAE9B1F60A412DBE1D5B095D7AC9DC0DCDDE3C1F5FB
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2018-01-17 to 2023-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ford.com","email:ais-cologne.com","email:ais-saarlouis.com","email:cotarko.com","email:european-llp.com","email:ford.com","email:fordcredit.com","email:forddirect.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:d1:d7:6d:17:bf:8a:e1:c6:10:89
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Jan 17 00:00:00 2018 GMT
            Not After : Jan 17 00:00:00 2023 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company - Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.ford.com
                  email:ais-cologne.com
                  email:ais-saarlouis.com
                  email:cotarko.com
                  email:european-llp.com
                  email:ford.com
                  email:fordcredit.com
                  email:forddirect.com
                  email:forsonordic.com
                  email:lincoln.com
                  email:lincolnafs.com
                  email:troydm.com
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3802E424516F78EEAC329AAE9B1F60A412DBE1D5B095D7AC9DC0DCDDE3C1F5FB
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ford.com","email:ais-cologne.com","email:ais-saarlouis.com","email:cotarko.com","email:european-llp.com","email:ford.com","email:fordcredit.com","email:forddirect.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ford Motor Company – Enterprise Issuing CA01

- Subject: countryName=US, organizationName=Ford Motor Company, localityName=Dearborn, stateOrProvinceName=Michigan, commonName=Ford Motor Company – Enterprise Issuing CA01
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 46228894F4E855CD53C21DD0438D
- SHA-256: 3625D9C482CD39E0DFBE8B76D7544F9FC93B78234B5F86C6CEDE2835EAA596A0
- SPKI SHA-256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
- Validity: 2015-02-25 to 2020-02-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:22:88:94:f4:e8:55:cd:53:c2:1d:d0:43:8d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 25 00:00:00 2015 GMT
            Not After : Feb 25 00:00:00 2020 GMT
        Subject: C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan, CN = Ford Motor Company \E2\80\93 Enterprise Issuing CA01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:C5:85:39:AD:69:E0:DF:B2:EC:D4:6D:34:A6:EB:F9:06:BD:67:9E
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.ach-llc2.com
                  email:.cotarko.com
                  email:.european-llp.com
                  email:.first-aquitaine.com
                  email:.fmcc.ch
                  email:.ford-alliance.com
                  email:.ford.com
                  email:.fordcredit.com
                  email:.forsonordic.com
                  email:.lincoln.com
                  email:.lincolnafs.com
                  email:.troydm.com
                  email:.volvoautobank.de
                  email:ach-llc2.com
                  email:cotarko.com
                  email:european-llp.com
                  email:first-aquitaine.com
                  email:fmcc.ch
                  email:ford-alliance.com
                  email:ford.com
                  email:fordcredit.com
                  email:forsonordic.com
                  email:lincoln.com
                  email:lincolnafs.com
                  email:troydm.com
                  email:volvoautobank.de
                  DNS:ford.com
                  DirName:C = US, O = Ford Motor Company, L = Dearborn, ST = Michigan
                  DirName:DC = com, DC = ford
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30513.10.1

                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3625D9C482CD39E0DFBE8B76D7544F9FC93B78234B5F86C6CEDE2835EAA596A0
    SPKI SHA256: 0AAC2C7551DAE93D16F69A2CE7E7FCF17D943635EBE30287A50F0CBAADE2A510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.5.5.7.3.14, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.30513.10.1, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.ach-llc2.com","email:.cotarko.com","email:.european-llp.com","email:.first-aquitaine.com","email:.fmcc.ch","email:.ford-alliance.com","email:.ford.com","email:.fordcredit.com","email:.forsonordic.com","email:.lincoln.com","email:.lincolnafs.com","email:.troydm.com","email:.volvoautobank.de","email:ach-llc2.com","email:cotarko.com","email:european-llp.com","email:first-aquitaine.com","email:fmcc.ch","email:ford-alliance.com","email:ford.com","email:fordcredit.com","email:forsonordic.com","email:lincoln.com","email:lincolnafs.com","email:troydm.com","email:volvoautobank.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GEMINI-CA

- Subject: domainComponent=edu, domainComponent=gemini, countryName=US, organizationalUnitName=Information Systems Group, organizationName=AURA - Gemini Observatory, commonName=GEMINI-CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000011C944A3669
- SHA-256: 732EE6FE56B41CB39F03AD99B468713C564632BA4A848FFDB65203C170C85E13
- SPKI SHA-256: 0ECEF68035748A848D587985D2202C252E6F3EE8050348A9534C6DA761C9BD8B
- Validity: 2008-09-24 to 2018-09-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1c:94:4a:36:69
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Sep 24 12:00:00 2008 GMT
            Not After : Sep 24 12:00:00 2018 GMT
        Subject: DC = edu, DC = gemini, C = US, OU = Information Systems Group, O = AURA - Gemini Observatory, CN = GEMINI-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                F2:FF:0B:2E:F5:3F:5D:75:90:DB:58:00:71:84:D4:1D:4B:F9:43:72
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 732EE6FE56B41CB39F03AD99B468713C564632BA4A848FFDB65203C170C85E13
    SPKI SHA256: 0ECEF68035748A848D587985D2202C252E6F3EE8050348A9534C6DA761C9BD8B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 45E6BB514607DE3977DC1AF23C8A
- SHA-256: 274EC3A5CF3A46B17A499788C7F2C36589E5541C178EB18786644C393C019BF1
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2014-12-10 to 2019-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:e6:bb:51:46:07:de:39:77:dc:1a:f2:3c:8a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Dec 10 00:00:00 2014 GMT
            Not After : Dec 10 00:00:00 2019 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.gi-de.com
                  email:.gi-de.de
                  email:.louisenthal.com
                  email:.louisenthal.de
                  email:gi-de.com
                  email:gi-de.de
                  email:louisenthal.com
                  email:louisenthal.de
                  DNS:gi-de.com
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10

                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 274EC3A5CF3A46B17A499788C7F2C36589E5541C178EB18786644C393C019BF1
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E528B2D024123DA7971338A6
- SHA-256: 632FD697BACAF1ED232517EC9B7622B7C25E1448B0CC626B33286719E351CE8A
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2017-08-23 to 2022-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.advance52.com","email:.gd-support.com","email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:advance52.com","email:gd-support.com","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b2:d0:24:12:3d:a7:97:13:38:a6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Aug 23 00:00:00 2017 GMT
            Not After : Aug 23 00:00:00 2022 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.advance52.com
                  email:.gd-support.com
                  email:.gi-de.com
                  email:.gi-de.de
                  email:.louisenthal.com
                  email:.louisenthal.de
                  email:.veridos.com
                  email:advance52.com
                  email:gd-support.com
                  email:gi-de.com
                  email:gi-de.de
                  email:louisenthal.com
                  email:louisenthal.de
                  email:veridos.com
                  DNS:gi-de.com
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 632FD697BACAF1ED232517EC9B7622B7C25E1448B0CC626B33286719E351CE8A
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.advance52.com","email:.gd-support.com","email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:advance52.com","email:gd-support.com","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 614945F955C5D85585A82A38EF61DF665C
- SHA-256: 663C9FDA690A98A29EDEA34B8C9C7C664D0AEAC635056E56CDA14D28D7CB155B
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2014-05-28 to 2019-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:49:45:f9:55:c5:d8:55:85:a8:2a:38:ef:61:df:66:5c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: May 28 00:00:00 2014 GMT
            Not After : May 28 00:00:00 2019 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:gi-de.com
                  email:gi-de.com
                  email:.gi-de.com
                  email:gi-de.de
                  email:.gi-de.de
                  email:louisenthal.com
                  email:.louisenthal.com
                  email:louisenthal.de
                  email:.louisenthal.de
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
            X509v3 Extended Key Usage:
                OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 663C9FDA690A98A29EDEA34B8C9C7C664D0AEAC635056E56CDA14D28D7CB155B
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 46F08CDA245D90213CD9938ED9D5
- SHA-256: C8A934D6A8E845F7A65F5C8F71FE44F528B85E326575A0D67939C74D80CD17D8
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2015-08-19 to 2020-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:f0:8c:da:24:5d:90:21:3c:d9:93:8e:d9:d5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Aug 19 00:00:00 2015 GMT
            Not After : Aug 19 00:00:00 2020 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.gi-de.com
                  email:.gi-de.de
                  email:.louisenthal.com
                  email:.louisenthal.de
                  email:.veridos.com
                  email:gi-de.com
                  email:gi-de.de
                  email:louisenthal.com
                  email:louisenthal.de
                  email:veridos.com
                  DNS:veridos.com
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8A934D6A8E845F7A65F5C8F71FE44F528B85E326575A0D67939C74D80CD17D8
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root nonTLS CA SHA256 G3
- Serial: 784AAA884738BA85F0D3FB81F2904F68
- SHA-256: 4AB23AF5233FD65FBD981973515A7379C76B9B852A5B4E35890B7F60D1923A4F
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2020-12-09 to 2022-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustrootnontlssha2g3
- CRL DP: http://crl.globalsign.com/trustrootnontlssha2g3.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.advance52.com","email:.gd-support.com","email:.gi-de.com","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:advance52.com","email:gd-support.com","email:gi-de.com","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:88:47:38:ba:85:f0:d3:fb:81:f2:90:4f:68
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root nonTLS CA SHA256 G3
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Aug 23 00:00:00 2022 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                29:F1:5C:83:62:5B:F7:3F:1C:D6:12:05:2B:49:A0:9B:26:AB:B3:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustrootnontlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootnontlssha2g3.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.advance52.com
                  email:.gd-support.com
                  email:.gi-de.com
                  email:.louisenthal.com
                  email:.louisenthal.de
                  email:.veridos.com
                  email:advance52.com
                  email:gd-support.com
                  email:gi-de.com
                  email:louisenthal.com
                  email:louisenthal.de
                  email:veridos.com
                  DNS:gi-de.com
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootnontlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4AB23AF5233FD65FBD981973515A7379C76B9B852A5B4E35890B7F60D1923A4F
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp.globalsign.com/trustrootnontlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootnontlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootnontlssha2g3.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.advance52.com","email:.gd-support.com","email:.gi-de.com","email:.louisenthal.com","email:.louisenthal.de","email:.veridos.com","email:advance52.com","email:gd-support.com","email:gi-de.com","email:louisenthal.com","email:louisenthal.de","email:veridos.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient CA

- Subject: countryName=DE, localityName=Munich, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 45D1E01261088DDC911560D14659
- SHA-256: CC9C20C89F2041240E7358EE16303A8E6EE429B1855A9ECB97889BCE9FFC576B
- SPKI SHA-256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
- Validity: 2014-11-25 to 2019-11-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:d1:e0:12:61:08:8d:dc:91:15:60:d1:46:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Nov 25 00:00:00 2014 GMT
            Not After : Nov 25 00:00:00 2019 GMT
        Subject: C = DE, L = Munich, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:68:BD:CE:43:80:E9:D7:73:3B:B9:DD:79:27:F0:DB:79:73:A0:C6
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.gi-de.com
                  email:.gi-de.de
                  email:.louisenthal.com
                  email:.louisenthal.de
                  email:gi-de.com
                  email:gi-de.de
                  email:louisenthal.com
                  email:louisenthal.de
                  DNS:gi-de.com
                  DirName:C = DE, L = Munich, O = Giesecke and Devrient
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11791.103.10

                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC9C20C89F2041240E7358EE16303A8E6EE429B1855A9ECB97889BCE9FFC576B
    SPKI SHA256: C7E7E8350E31FE395804731781AE73541D1434E311C719E3BB994E8EDBA1526A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.11791.103.10, 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.gi-de.com","email:.gi-de.de","email:.louisenthal.com","email:.louisenthal.de","email:gi-de.com","email:gi-de.de","email:louisenthal.com","email:louisenthal.de"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] error e_tbs_signature_rsa_encryption_parameter_not_null: certificate tbsCertificate.signature RSA algorithm identifier missing required NULL parameter

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Giesecke and Devrient Corporate CA

- Subject: countryName=DE, organizationName=Giesecke and Devrient, organizationalUnitName=Corporate CA, commonName=Giesecke and Devrient Corporate CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000011E4487922D
- SHA-256: DC83891E1005E480698CF7E14D0F05B701195B0766FC84462D9D8739E9BFCE1C
- SPKI SHA-256: 7F0E8B6FFEA30C9B2B5960D4F122CF7AFDFD18D28BBD86C60A78D0AFA662FB1E
- Validity: 2008-12-17 to 2018-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:87:92:2d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec 17 12:00:00 2008 GMT
            Not After : Dec 17 12:00:00 2018 GMT
        Subject: C = DE, O = Giesecke and Devrient, OU = Corporate CA, CN = Giesecke and Devrient Corporate CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                27:BC:E3:C6:83:58:F1:88:D4:B4:35:2A:2C:11:77:0D:24:49:C8:15
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DC83891E1005E480698CF7E14D0F05B701195B0766FC84462D9D8739E9BFCE1C
    SPKI SHA256: 7F0E8B6FFEA30C9B2B5960D4F122CF7AFDFD18D28BBD86C60A78D0AFA662FB1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 04000000000125071DF9AF
- SHA-256: FDFC6560B09C237F468B8130EB90996FF85FA13FA266239B8D5863798D6AB898
- SPKI SHA-256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
- Validity: 2009-11-18 to 2019-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLSHA256CACross
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:07:1d:f9:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Nov 18 10:00:00 2009 GMT
            Not After : Mar 18 10:00:00 2019 GMT
        Subject: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLSHA256CACross
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FDFC6560B09C237F468B8130EB90996FF85FA13FA266239B8D5863798D6AB898
    SPKI SHA256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLSHA256CACross
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 01EE5F169DFF97352B6465D66A
- SHA-256: 445EEC78BC61215044A0379656AA2D5DB5E42F76CB70B8D14C2077AA943D4EBB
- SPKI SHA-256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
- Validity: 2018-09-19 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r3.crl, http://crl.globalsign.net/root-r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 445EEC78BC61215044A0379656AA2D5DB5E42F76CB70B8D14C2077AA943D4EBB
    SPKI SHA256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 751E3F53E3185933E95F08ECEEAD0297
- SHA-256: F349954E8FB6D44011BCB789D97D9A2CB2032BD5F0B598D1FB8A099F5848D523
- SPKI SHA-256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
- Validity: 2019-06-19 to 2028-01-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r5.crl, http://crl.globalsign.com/gs/root-r5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:53:e3:18:59:33:e9:5f:08:ec:ee:ad:02:97
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jun 19 00:00:00 2019 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F349954E8FB6D44011BCB789D97D9A2CB2032BD5F0B598D1FB8A099F5848D523
    SPKI SHA256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE14B94
- SHA-256: C94FEDDA4E8608908580BC7F87B434E03BB262E42F64C63820A8F50FB17C1CEC
- SPKI SHA-256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
- Validity: 2009-03-18 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r3.crl, http://crl.globalsign.net/root-r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:4b:94
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 18 10:00:00 2009 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C94FEDDA4E8608908580BC7F87B434E03BB262E42F64C63820A8F50FB17C1CEC
    SPKI SHA256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 751E3F5649E74CBBF69D0026B67CAA8C
- SHA-256: C84E1378B974A991ACDCDD733421E3061E6FA21A0491C8902BAFDE3855E0063E
- SPKI SHA-256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
- Validity: 2019-06-19 to 2028-01-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:56:49:e7:4c:bb:f6:9d:00:26:b6:7c:aa:8c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jun 19 00:00:00 2019 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C84E1378B974A991ACDCDD733421E3061E6FA21A0491C8902BAFDE3855E0063E
    SPKI SHA256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE14952
- SHA-256: 4EF06B3815B05FCCA7A66B35DC2229F4BBC600B46E1E083CF7F0D6D1C406559C
- SPKI SHA-256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
- Validity: 2006-12-15 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:49:52
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Dec 15 08:00:00 2006 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4EF06B3815B05FCCA7A66B35DC2229F4BBC600B46E1E083CF7F0D6D1C406559C
    SPKI SHA256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F223E3D355B992BC82AB4
- SHA-256: 3F319B2AFED4A0F75127BE59925550D0428E68763A09E273EB6A9FF8D18DBB5B
- SPKI SHA-256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
- Validity: 2018-11-21 to 2029-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r5.crl, http://crl.globalsign.com/gs/root-r5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:3e:3d:35:5b:99:2b:c8:2a:b4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3F319B2AFED4A0F75127BE59925550D0428E68763A09E273EB6A9FF8D18DBB5B
    SPKI SHA256: 7E0EAD76BB6819DC2F54511A84354F6E8B307B9DD82058EA6C004F01D9DDA5DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 04000000000125071DF6D0
- SHA-256: 52D60074D5D0E65F080CA3CD6A31BC94762F26583A0A99A4135ACAF94A691DA9
- SPKI SHA-256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
- Validity: 2009-11-18 to 2019-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:07:1d:f6:d0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Nov 18 10:00:00 2009 GMT
            Not After : Mar 18 10:00:00 2019 GMT
        Subject: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52D60074D5D0E65F080CA3CD6A31BC94762F26583A0A99A4135ACAF94A691DA9
    SPKI SHA256: 706BB1017C855C59169BAD5C1781CF597F12D2CAD2F63D1A4AA37493800FFB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01F2404240CEFD22DBE96C71FC
- SHA-256: DDA8DA736187D76F4F0ED5A5F667B54D99A98AE06091D0E3A01714E9221695AD
- SPKI SHA-256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
- Validity: 2019-02-20 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 20 00:00:00 2019 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DDA8DA736187D76F4F0ED5A5F667B54D99A98AE06091D0E3A01714E9221695AD
    SPKI SHA256: 682747F8BA621B87CDD3BC295ED5CABCE722A1C0C0363D1D68B38928D2787F1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE14710
- SHA-256: 58421CD0372F695FC60D225632D721AF93F00C3A03091C1E0436DBCFE953C4FC
- SPKI SHA-256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
- Validity: 2006-12-15 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/root-r2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:47:10
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Dec 15 08:00:00 2006 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 58421CD0372F695FC60D225632D721AF93F00C3A03091C1E0436DBCFE953C4FC
    SPKI SHA256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign 4096 Administration CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign 4096 Administration CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 468E757B50E99E36C7DCB29D8216
- SHA-256: 181B851519D2F1C3FEBA5118FF49D0B64E3C4D5673D62AC6471C4469522D3AE6
- SPKI SHA-256: 8B099EAC96ADEE8BE8D382852708E37CB9749E21B37B021CB77F90813E7580D7
- Validity: 2015-05-20 to 2020-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:8e:75:7b:50:e9:9e:36:c7:dc:b2:9d:82:16
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 20 00:00:00 2015 GMT
            Not After : May 20 00:00:00 2020 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign 4096 Administration CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:E1:9F:11:2B:6A:30:65:BF:67:A9:AD:FD:CE:DF:06:EA:88:BD:B3
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 181B851519D2F1C3FEBA5118FF49D0B64E3C4D5673D62AC6471C4469522D3AE6
    SPKI SHA256: 8B099EAC96ADEE8BE8D382852708E37CB9749E21B37B021CB77F90813E7580D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign AATL Partners CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign AATL Partners CA 2019
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 11D71C3B040319CAB90775A3CB5989CD8CD5
- SHA-256: 83FC891B350D9E0D7EBE6DD2A6BFE3D0B0F4653FCA048615A5DEEBBC039A3F66
- SPKI SHA-256: 9612500BB176AED81058869906DE333973B813D3FCD9BB1BE3BB848A323EA5C3
- Validity: 2019-04-30 to 2029-04-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d7:1c:3b:04:03:19:ca:b9:07:75:a3:cb:59:89:cd:8c:d5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 30 00:00:00 2019 GMT
            Not After : Apr 30 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign AATL Partners CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                2C:94:2C:D0:D0:8B:6D:7F:D8:52:BD:74:0A:A8:58:D8:65:42:FA:28
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 83FC891B350D9E0D7EBE6DD2A6BFE3D0B0F4653FCA048615A5DEEBBC039A3F66
    SPKI SHA256: 9612500BB176AED81058869906DE333973B813D3FCD9BB1BE3BB848A323EA5C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Atlas E45 AATL CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 AATL CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Root CA 2020
- Serial: 85151BF512DD01348A2FAAB1EC7165F4
- SHA-256: 4BFD9633EFB882AD5DE6E63C954E9EBC48CD0AA4FD824DED4F7034E8D2A018BA
- SPKI SHA-256: D694F19FFE1DE57683917E597CB9565916B2FD84842808371EF001BD58C298C7
- Validity: 2026-01-21 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45aatlca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gse45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gse45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:1b:f5:12:dd:01:34:8a:2f:aa:b1:ec:71:65:f4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E45 AATL Root CA 2020
        Validity
            Not Before: Jan 21 04:21:27 2026 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 AATL CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                ED:58:3F:00:D8:AC:EC:BA:D2:7C:B3:6D:0F:C9:57:5C:6D:F3:57:38
            X509v3 Authority Key Identifier:
                6D:CF:6B:22:48:1C:08:57:3E:F7:F5:11:81:FB:26:75:9C:54:AB:47
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gse45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gse45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gse45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4BFD9633EFB882AD5DE6E63C954E9EBC48CD0AA4FD824DED4F7034E8D2A018BA
    SPKI SHA256: D694F19FFE1DE57683917E597CB9565916B2FD84842808371EF001BD58C298C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gse45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gse45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gse45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 Client Authentication CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Client Authentication CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 83148A1F147E3381274918F155A41090
- SHA-256: 1A924B6032DF2E8EC67E149BF68708F6006E53B4DE4899722410BACCABDFCD44
- SPKI SHA-256: D34AC610682ECB7D94136E46A82494DAB718CCEB7CA79C99E94E7EB4C2FC3EAC
- Validity: 2025-03-19 to 2035-03-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45clientauthca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:8a:1f:14:7e:33:81:27:49:18:f1:55:a4:10:90
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Mar 19 03:32:28 2025 GMT
            Not After : Mar 19 00:00:00 2035 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 Client Authentication CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8B:9B:44:AD:03:E2:86:8B:2C:41:B1:83:CA:E8:7F:80:77:9C:4C:23
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1A924B6032DF2E8EC67E149BF68708F6006E53B4DE4899722410BACCABDFCD44
    SPKI SHA256: D34AC610682ECB7D94136E46A82494DAB718CCEB7CA79C99E94E7EB4C2FC3EAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 Qualified Authentication CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Authentication CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 79B9FF054724EC3A4BD3B518F8F1130E
- SHA-256: 102DCE6691C0B6DF7CD2521AF88C3546D7582A2CB7DAAD087F9C7DB2AF8351C5
- SPKI SHA-256: B544A2D35784864B05FC5A098841B8A12C43F5D2F0AA5DE9961AD7B8E0D76A30
- Validity: 2021-05-19 to 2031-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45qualauthca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:05:47:24:ec:3a:4b:d3:b5:18:f8:f1:13:0e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 Qualified Authentication CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                49:76:2B:F9:5C:D5:65:71:DF:16:D8:D2:C6:93:CB:61:14:60:88:1F
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 102DCE6691C0B6DF7CD2521AF88C3546D7582A2CB7DAAD087F9C7DB2AF8351C5
    SPKI SHA256: B544A2D35784864B05FC5A098841B8A12C43F5D2F0AA5DE9961AD7B8E0D76A30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 Qualified Non QSCD Signing CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Non QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 79B9FF6D137E80C4E2E1B41C36FFD954
- SHA-256: DBFF9EBA713FF77B60D52B37F35C5AD52D9CD06412F3BAD9128D77D95C7B887E
- SPKI SHA-256: 6008650EEBA50845E0BF1D55D2223EEBA60CB5D20FEB3A14F8B307FD5B80AB00
- Validity: 2021-05-19 to 2031-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45qualnonqscdsignca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:6d:13:7e:80:c4:e2:e1:b4:1c:36:ff:d9:54
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 Qualified Non QSCD Signing CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:37:0A:50:99:73:E7:64:1D:37:1B:80:EC:48:97:D0:FA:56:3A:D1
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DBFF9EBA713FF77B60D52B37F35C5AD52D9CD06412F3BAD9128D77D95C7B887E
    SPKI SHA256: 6008650EEBA50845E0BF1D55D2223EEBA60CB5D20FEB3A14F8B307FD5B80AB00
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 Qualified QSCD Signing CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 79B9FF6F6872FE488C86162A1E33A582
- SHA-256: 625597092D6B09F1AB74ECF29F38E0E1C41AF487594B23489A8A604687ACAD99
- SPKI SHA-256: E1D6F94DE0214940FB1D117036628FCCB823996447034FA8CDECB16C5A459F42
- Validity: 2021-05-19 to 2031-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45qualqscdsignca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:6f:68:72:fe:48:8c:86:16:2a:1e:33:a5:82
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 Qualified QSCD Signing CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:8F:4D:AC:3B:40:15:6A:9F:44:2F:33:51:BD:03:C8:6E:9D:FF:D5
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 625597092D6B09F1AB74ECF29F38E0E1C41AF487594B23489A8A604687ACAD99
    SPKI SHA256: E1D6F94DE0214940FB1D117036628FCCB823996447034FA8CDECB16C5A459F42
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 Qualified Remote Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E45 Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 7803188A373C5EE36B00FEC2A2FCF27E
- SHA-256: 5CB0FDEF052BD18A0A40ADA2235F46EB42B6D0993ED5A50DE47E3EA12FF191B1
- SPKI SHA-256: 83B0B44202171F58E05FBB5832183FE8F5262F6979FBCE58E4B823E804B0A092
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45qualremotesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:8a:37:3c:5e:e3:6b:00:fe:c2:a2:fc:f2:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E45 Qualified Remote Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DD:67:CA:5A:3B:BE:91:4E:9A:74:94:E1:B2:65:46:31:E8:42:CF:91
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5CB0FDEF052BD18A0A40ADA2235F46EB42B6D0993ED5A50DE47E3EA12FF191B1
    SPKI SHA256: 83B0B44202171F58E05FBB5832183FE8F5262F6979FBCE58E4B823E804B0A092
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E45 UK Qualified Remote Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas E45 UK Qualified Remote Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 784AA91D75D14FAD21FC5F0E8A2A0DC5
- SHA-256: B89EBBFC57AE60653C676B8EB399DC9415BBB738CB0370651A86BFF075C83A39
- SPKI SHA-256: D2858A9256D35CB96540C1B8596E940D3D8F838343CC81373AC07F3D057A0209
- Validity: 2020-09-16 to 2030-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase45ukqualremotesignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:1d:75:d1:4f:ad:21:fc:5f:0e:8a:2a:0d:c5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2030 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign Atlas E45 UK Qualified Remote Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CE:87:5F:71:38:BD:6F:43:01:3F:2D:53:DE:71:B4:8B:E7:58:FA:5C
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B89EBBFC57AE60653C676B8EB399DC9415BBB738CB0370651A86BFF075C83A39
    SPKI SHA256: D2858A9256D35CB96540C1B8596E940D3D8F838343CC81373AC07F3D057A0209
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 DV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83431C5B9B8155E3BE9DF74944E722DC
- SHA-256: DD400AD8AE3545BE8D7C74A27F77AAC2C5CD74C366C4DEA1EA1DB36778381989
- SPKI SHA-256: 37A9AB05D1C1EDF60899F0CC70B0E0C2DF53E7DC990A10C279D29D8B023ABB93
- Validity: 2025-04-16 to 2027-06-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46dvtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:5b:9b:81:55:e3:be:9d:f7:49:44:e7:22:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 16 03:14:25 2025 GMT
            Not After : Jun 30 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0B:58:13:54:05:E4:B6:79:E8:91:C0:47:DE:29:7C:88:FD:08:2E:5C
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DD400AD8AE3545BE8D7C74A27F77AAC2C5CD74C366C4DEA1EA1DB36778381989
    SPKI SHA256: 37A9AB05D1C1EDF60899F0CC70B0E0C2DF53E7DC990A10C279D29D8B023ABB93
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 DV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83DA86BD574B63839BBBA81CE784FEC3
- SHA-256: FEDE979C0D16F9FF1C5A824DEDB0AF24E1AF8ECF20227489026B32108CC9C6F3
- SPKI SHA-256: B886AFF58B299D7667F2EECCB5AF560ECFECB8ED2D8D1898A0769175D7E17DED
- Validity: 2025-07-16 to 2027-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46dvtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:bd:57:4b:63:83:9b:bb:a8:1c:e7:84:fe:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 16 03:06:50 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C5:2F:C6:79:13:6D:0D:A2:6E:FF:B8:00:9C:58:AA:2E:AF:81:BE:44
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FEDE979C0D16F9FF1C5A824DEDB0AF24E1AF8ECF20227489026B32108CC9C6F3
    SPKI SHA256: B886AFF58B299D7667F2EECCB5AF560ECFECB8ED2D8D1898A0769175D7E17DED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 DV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8471F4215E6FA098AAE744FBA8595286
- SHA-256: 035250381A210A3142AB058B5FB4732F8B0EC52B2758A60304FC43A14B57F784
- SPKI SHA-256: 1EDAB83619D01FC0EBA85D542B8BEF962709EA3200D75852F37BF99584382C55
- Validity: 2025-10-15 to 2027-10-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46dvtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:21:5e:6f:a0:98:aa:e7:44:fb:a8:59:52:86
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 15 03:09:25 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                00:1E:C8:34:50:1E:53:ED:1C:20:62:BC:E2:75:A2:B0:CB:50:DC:86
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 035250381A210A3142AB058B5FB4732F8B0EC52B2758A60304FC43A14B57F784
    SPKI SHA256: 1EDAB83619D01FC0EBA85D542B8BEF962709EA3200D75852F37BF99584382C55
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 DV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 851503EC025ABDE307F5ECCE624ECF71
- SHA-256: 1F361F27E8CB224ED70498730AE8C8553854EC33EF04F3CA23AE8801F57AB5BB
- SPKI SHA-256: 355D04DB7FCAA0BC0075A1E85D640D168E725E44CD93FEC709ED5A6627F46FE3
- Validity: 2026-01-21 to 2028-01-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46dvtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:ec:02:5a:bd:e3:07:f5:ec:ce:62:4e:cf:71
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 21 03:00:12 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D1:C1:C1:F2:E1:15:B2:3A:19:8A:60:2D:A9:6C:BC:83:DF:D6:4D:8A
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1F361F27E8CB224ED70498730AE8C8553854EC33EF04F3CA23AE8801F57AB5BB
    SPKI SHA256: 355D04DB7FCAA0BC0075A1E85D640D168E725E44CD93FEC709ED5A6627F46FE3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 DV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 85AC70912393B99FE5F09B231023E14E
- SHA-256: 761102F1D7AEB9EE364B3EA0464E553B4BAACB74963D46501905D50C0F91B95C
- SPKI SHA-256: FAAAD44E77287F2717B1B37CA3A4986E1977A71AEB62D0F34D84A897FFD49578
- Validity: 2026-04-22 to 2028-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46dvtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:91:23:93:b9:9f:e5:f0:9b:23:10:23:e1:4e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 22 03:00:16 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                63:5A:1F:AF:BA:E4:1F:4F:CE:EC:1E:74:DE:AE:CB:DB:6F:21:7E:1E
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 761102F1D7AEB9EE364B3EA0464E553B4BAACB74963D46501905D50C0F91B95C
    SPKI SHA256: FAAAD44E77287F2717B1B37CA3A4986E1977A71AEB62D0F34D84A897FFD49578
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 DV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 DV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8643E53B7C76DDFA8C873DC6F4D5CCBB
- SHA-256: D709B1E35A1B4D4724C01B3FB88860DFDFCB66AEF1DE05F9A349F4DC358FCEDE
- SPKI SHA-256: 4B52F35E280F4D0C99FB1CB52336AF67C9FEC1C30EC3ADAB94C4BE667BF550E5
- Validity: 2026-07-22 to 2028-07-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:3b:7c:76:dd:fa:8c:87:3d:c6:f4:d5:cc:bb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 22 03:27:27 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 DV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                59:A2:34:19:7B:15:8B:89:78:CB:FA:E2:D5:68:B6:C7:F9:82:72:96
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D709B1E35A1B4D4724C01B3FB88860DFDFCB66AEF1DE05F9A349F4DC358FCEDE
    SPKI SHA256: 4B52F35E280F4D0C99FB1CB52336AF67C9FEC1C30EC3ADAB94C4BE667BF550E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV QWAC CA 2022Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 79B9FEF98A254742B20FADA1D252D108
- SHA-256: 4D81D18D57CDA96440CBFD0FA05CC387B7C69DE3A9E68B4036E1168EE2B7BD21
- SPKI SHA-256: 472355855D42E7EC579691D1E542EACCEBAD376C2551335531A5B80C86449E92
- Validity: 2021-05-19 to 2024-03-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2022q1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:f9:8a:25:47:42:b2:0f:ad:a1:d2:52:d1:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Mar 31 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2022Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C0:0E:16:BA:57:0C:AF:51:9B:21:BB:F7:5A:ED:89:BE:83:6D:F1:3B
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4D81D18D57CDA96440CBFD0FA05CC387B7C69DE3A9E68B4036E1168EE2B7BD21
    SPKI SHA256: 472355855D42E7EC579691D1E542EACCEBAD376C2551335531A5B80C86449E92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2022Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 79B9FEFD8AA5BBDD20C7D52F9CB211DC
- SHA-256: ED2B6C6F6C669EEC6C158B0FD61E4454185C42842523866F3B3EE9B1F0F62882
- SPKI SHA-256: AD67B15834CA0080894DD27FA8F4270BBA95074E57124A63C040D71A61C4DDAF
- Validity: 2021-05-19 to 2024-06-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2022q2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:fd:8a:a5:bb:dd:20:c7:d5:2f:9c:b2:11:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Jun 30 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2022Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:0A:F6:03:84:E7:16:5F:B0:F5:9B:C8:E3:FE:94:5C:4F:44:8B:8F
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ED2B6C6F6C669EEC6C158B0FD61E4454185C42842523866F3B3EE9B1F0F62882
    SPKI SHA256: AD67B15834CA0080894DD27FA8F4270BBA95074E57124A63C040D71A61C4DDAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2022Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 79B9FEFFDA226E404045238A5322315A
- SHA-256: 0DA5820FDFE4FCF9B9F94C140DB0F06D670D86FCB1BDD9597BCA8731532F353C
- SPKI SHA-256: 319CCC9DE23B4A7C9278418FF40CE76BBE0A542495C9DF18E08E1BD2D907B4B2
- Validity: 2021-05-19 to 2024-09-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2022q3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:ff:da:22:6e:40:40:45:23:8a:53:22:31:5a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Sep 30 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2022Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E2:9F:F1:4C:4E:EF:38:FE:CC:A3:DB:85:CB:FC:9F:C7:FF:81:F7:99
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0DA5820FDFE4FCF9B9F94C140DB0F06D670D86FCB1BDD9597BCA8731532F353C
    SPKI SHA256: 319CCC9DE23B4A7C9278418FF40CE76BBE0A542495C9DF18E08E1BD2D907B4B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2022Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2022Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 79B9FF02A233A6C780DFEB0F084C8935
- SHA-256: 4EF99E6A8B14F69938715371B1D853472534CBF595A743CE993E7B386F99B895
- SPKI SHA-256: EED413A6CFC5C8DABCE26EFBD913566E0D18B688558538BCED865A86C767A1CE
- Validity: 2021-05-19 to 2024-12-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2022q4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:02:a2:33:a6:c7:80:df:eb:0f:08:4c:89:35
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Dec 31 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2022Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F6:9A:4E:88:A6:C8:0D:C1:3C:F8:D6:4D:8D:3B:DD:64:66:8A:92:F8
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4EF99E6A8B14F69938715371B1D853472534CBF595A743CE993E7B386F99B895
    SPKI SHA256: EED413A6CFC5C8DABCE26EFBD913566E0D18B688558538BCED865A86C767A1CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2023Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7BFB7459AF9A80A4E58210E76A95CF19
- SHA-256: F9120A71D50697B9992A7357A0A9A0DDC4BFC3598FCB4F01642964824D3CF276
- SPKI SHA-256: D4BA5F8D5487F21A33B4181F77F819163882EEFE9E68091592055378BEA94691
- Validity: 2022-03-23 to 2025-03-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2023q1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:59:af:9a:80:a4:e5:82:10:e7:6a:95:cf:19
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Mar 31 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2023Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                70:F7:11:ED:91:4C:B3:3D:29:AE:EC:D6:EC:1C:20:C5:42:50:3E:EA
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F9120A71D50697B9992A7357A0A9A0DDC4BFC3598FCB4F01642964824D3CF276
    SPKI SHA256: D4BA5F8D5487F21A33B4181F77F819163882EEFE9E68091592055378BEA94691
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2023Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7BFB7461591AC1632E4943A9076E424C
- SHA-256: F4C5F3956379493830DE7456E0A55D6FBC1B8EA08B756488FF005B6C394A69C7
- SPKI SHA-256: 101653B3C2BDCCC30408206D4D4D07805FB1D2CC7DEAD5703F47F7DEEF02568D
- Validity: 2022-03-23 to 2025-06-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2023q2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:61:59:1a:c1:63:2e:49:43:a9:07:6e:42:4c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Jun 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2023Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FB:28:16:AF:57:01:FC:89:B1:FD:BA:C6:64:2D:7F:B2:1A:4A:6A:D6
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F4C5F3956379493830DE7456E0A55D6FBC1B8EA08B756488FF005B6C394A69C7
    SPKI SHA256: 101653B3C2BDCCC30408206D4D4D07805FB1D2CC7DEAD5703F47F7DEEF02568D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2023Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7BFB746476061C4841A1DB45E80E0CD4
- SHA-256: 430B172A6F7146B16A75BCC5BFA1D60C61DEEAA2ABAC61B4394E4A6B291C48CC
- SPKI SHA-256: A29B707B5A1C1A483B0D7724EE33831B9CFFBFC66DEF67EF601A03CD44573A26
- Validity: 2022-03-23 to 2025-09-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2023q3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:64:76:06:1c:48:41:a1:db:45:e8:0e:0c:d4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Sep 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2023Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A7:C7:4B:34:86:E8:93:FE:BE:C3:36:BB:4F:B9:CE:18:28:04:73:64
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 430B172A6F7146B16A75BCC5BFA1D60C61DEEAA2ABAC61B4394E4A6B291C48CC
    SPKI SHA256: A29B707B5A1C1A483B0D7724EE33831B9CFFBFC66DEF67EF601A03CD44573A26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV QWAC CA 2023Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV QWAC CA 2023Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7BFB7468AA2028073A3B9271AA4B8BDE
- SHA-256: 2DA52277662DC1C779E2439FAF58F85F87DBA73E0F16F1B0EB310A4919CFC3BA
- SPKI SHA-256: 0DF99B82CAC8C5EF3F379526DED67A57FE3BA6D3E6A72F7334C6C2C57713C780
- Validity: 2022-03-23 to 2025-12-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evqwacca2023q4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:68:aa:20:28:07:3a:3b:92:71:aa:4b:8b:de
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Dec 31 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV QWAC CA 2023Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                90:27:D1:13:BA:5C:2D:77:93:8C:15:5A:8D:E9:9A:EE:16:AE:77:75
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2DA52277662DC1C779E2439FAF58F85F87DBA73E0F16F1B0EB310A4919CFC3BA
    SPKI SHA256: 0DF99B82CAC8C5EF3F379526DED67A57FE3BA6D3E6A72F7334C6C2C57713C780
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 780318361CA83DB67636472590F15A2B
- SHA-256: 364DF25CC88F6FB0202C02CD9B8EA02DFE8AC02341EFF5A9DFFC5BE159ED5991
- SPKI SHA-256: 060C41AFBFEAEC0D1CFCF5D05B40C065F2216BBEB8383FB2607FFFF79FD233F0
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:36:1c:a8:3d:b6:76:36:47:25:90:f1:5a:2b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:E9:97:D2:05:EF:F7:86:5A:90:8F:7E:1F:88:65:E7:28:EB:E5:F4
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 364DF25CC88F6FB0202C02CD9B8EA02DFE8AC02341EFF5A9DFFC5BE159ED5991
    SPKI SHA256: 060C41AFBFEAEC0D1CFCF5D05B40C065F2216BBEB8383FB2607FFFF79FD233F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7AFB33CF592D63FF2271FE2505A80C91
- SHA-256: 9C9D5E986B5BEA7A1EC8457EBCAA600D2435803B91FEC97C4E5043BE6742D4B1
- SPKI SHA-256: 0D0199A84A103863E4DD319E4A0C3432FDD87A114F99A0ED75EE214FF6694156
- Validity: 2021-10-20 to 2024-10-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:cf:59:2d:63:ff:22:71:fe:25:05:a8:0c:91
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:0D:BB:F6:BA:BB:F0:EC:B6:27:13:0E:2F:8C:94:A4:56:F0:2E:43
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9C9D5E986B5BEA7A1EC8457EBCAA600D2435803B91FEC97C4E5043BE6742D4B1
    SPKI SHA256: 0D0199A84A103863E4DD319E4A0C3432FDD87A114F99A0ED75EE214FF6694156
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7B9E423F144EC4F0165F800A384CE2B4
- SHA-256: 5E2A73EE6069DE65322DCF0430176B385F5238C296EE4392E7ED7DB4BE908A40
- SPKI SHA-256: E1FF3727D8C19FD6C35EC0DFC23E7B094E54BEFF1CD34DD954388A660A0B97EA
- Validity: 2022-01-26 to 2025-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:3f:14:4e:c4:f0:16:5f:80:0a:38:4c:e2:b4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                65:B1:12:EA:CC:8B:4E:B7:8D:7C:3B:18:7B:09:D2:15:45:5B:D1:82
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5E2A73EE6069DE65322DCF0430176B385F5238C296EE4392E7ED7DB4BE908A40
    SPKI SHA256: E1FF3727D8C19FD6C35EC0DFC23E7B094E54BEFF1CD34DD954388A660A0B97EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7C2A0C708331908F392D49C000D05DCB
- SHA-256: 4006CDFF6D8D52DC090FF5382B9C30CEA8CC5005DF2D5E8203CD67921797750D
- SPKI SHA-256: B3DA8D78FD68033DCC2F6D5122BF4D77F9D1D4BD5B71AA7330AA59FF632A29ED
- Validity: 2022-04-20 to 2025-04-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:70:83:31:90:8f:39:2d:49:c0:00:d0:5d:cb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:86:DF:C2:F3:87:A3:51:05:3C:5B:FF:40:B7:FC:82:0D:8B:B5:3B
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4006CDFF6D8D52DC090FF5382B9C30CEA8CC5005DF2D5E8203CD67921797750D
    SPKI SHA256: B3DA8D78FD68033DCC2F6D5122BF4D77F9D1D4BD5B71AA7330AA59FF632A29ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2022 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7CC1752391C27FB3AC7D04CE9345CE7B
- SHA-256: A34B15C8D1C296106ACBC14680160027B1FA49114C21BD99B3AE59BD8C4C7B54
- SPKI SHA-256: 50CB3333E2F6FD6F4255492DB3845BADBBF021D51AB3ACDF35926E91350FB6BB
- Validity: 2022-07-20 to 2024-07-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:75:23:91:c2:7f:b3:ac:7d:04:ce:93:45:ce:7b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 20 03:26:46 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0C:D5:0D:D7:23:DB:2D:59:92:10:65:0D:6E:D7:47:EB:27:CC:94:FC
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A34B15C8D1C296106ACBC14680160027B1FA49114C21BD99B3AE59BD8C4C7B54
    SPKI SHA256: 50CB3333E2F6FD6F4255492DB3845BADBBF021D51AB3ACDF35926E91350FB6BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7D4D4296C0B2175A5DBD12A22451F2B2
- SHA-256: 8D1EE31E047C9E604CF0603A9076DC45A7BD4D4AF4584D2156F03752626D8A6E
- SPKI SHA-256: A328199B3FEF660EC9608AAD0A829962A52D432665AB89D0FD3FEF5C24E7C37D
- Validity: 2022-10-12 to 2024-10-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:96:c0:b2:17:5a:5d:bd:12:a2:24:51:f2:b2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 12 03:49:29 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9A:F9:9F:70:91:48:A3:A1:7E:B5:3D:D5:AF:0E:E0:4C:59:6F:64:88
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8D1EE31E047C9E604CF0603A9076DC45A7BD4D4AF4584D2156F03752626D8A6E
    SPKI SHA256: A328199B3FEF660EC9608AAD0A829962A52D432665AB89D0FD3FEF5C24E7C37D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7DF051AFA52B0B8BA456A34E0B7FE88E
- SHA-256: B95D0B51AAB7504D0F8780173B8C395DD718371BA61ADE30C11B1B77B33EC01B
- SPKI SHA-256: DBDBCF171D3FC9DF6271B865BC75791F5F657989D3601DBC0034737FACAAA9BA
- Validity: 2023-01-18 to 2025-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:af:a5:2b:0b:8b:a4:56:a3:4e:0b:7f:e8:8e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 18 03:37:55 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:1C:F2:A3:72:68:70:C3:8E:CA:DA:5E:BD:32:C4:09:8D:DD:05:89
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B95D0B51AAB7504D0F8780173B8C395DD718371BA61ADE30C11B1B77B33EC01B
    SPKI SHA256: DBDBCF171D3FC9DF6271B865BC75791F5F657989D3601DBC0034737FACAAA9BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7E87C2F91B1E7AD818FA3787866E6DEE
- SHA-256: 40D44FA09A260E8FCD527293AA965F247B31E2104FA51B36D263B0479FB828F2
- SPKI SHA-256: 555705931D78F04CD42D04E4279ADB40006EE606B88FF27D30A26B2D218354BB
- Validity: 2023-04-19 to 2025-04-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:f9:1b:1e:7a:d8:18:fa:37:87:86:6e:6d:ee
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 19 03:53:40 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                71:D2:B8:C3:3E:7B:A5:8E:BA:80:4C:69:8F:B4:1D:F4:06:04:1C:F9
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 40D44FA09A260E8FCD527293AA965F247B31E2104FA51B36D263B0479FB828F2
    SPKI SHA256: 555705931D78F04CD42D04E4279ADB40006EE606B88FF27D30A26B2D218354BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2023 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7F1F2C88FD172903A3202B0762D9769C
- SHA-256: 1DFFC2AD5B423DCC715DFE54AA117F2525974D9571FEA82819232807F4ADD4EE
- SPKI SHA-256: 893AF308E4C68C53E97C26218FD5FF19EB6DDE98F9A0F53A307C9F23968AE743
- Validity: 2023-07-19 to 2025-07-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:88:fd:17:29:03:a3:20:2b:07:62:d9:76:9c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 19 03:43:19 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:C4:F2:F2:F8:D0:CF:0D:79:A3:4F:69:21:F1:41:71:7D:53:65:60
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1DFFC2AD5B423DCC715DFE54AA117F2525974D9571FEA82819232807F4ADD4EE
    SPKI SHA256: 893AF308E4C68C53E97C26218FD5FF19EB6DDE98F9A0F53A307C9F23968AE743
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7FB6A137902A871543C78817A1126820
- SHA-256: D78BE04CDBE328D5493489067B8DF1C57E65EA74D8888F08C711E815A6A11A14
- SPKI SHA-256: 1AE0E0B9D2396A6E8730C623BC78C0C76C5A7E306C22A2E6957971F4DCDD5785
- Validity: 2023-10-18 to 2025-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a1:37:90:2a:87:15:43:c7:88:17:a1:12:68:20
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 18 04:10:33 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7A:59:FB:4A:BB:5B:6D:CD:3F:AA:3D:A6:57:04:88:27:BD:E3:07:E1
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D78BE04CDBE328D5493489067B8DF1C57E65EA74D8888F08C711E815A6A11A14
    SPKI SHA256: 1AE0E0B9D2396A6E8730C623BC78C0C76C5A7E306C22A2E6957971F4DCDD5785
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 804E00796FA71F8D7C2746015B1CB699
- SHA-256: 04E808603BE46B2534562E3DE237F4AE7ABE2B5E3141D8DEC470A822370D3DB7
- SPKI SHA-256: EBAD2755CBCD45C16C477B3BA0749C14CC9B6D1E8A890CCF78ABD22BEF832BF9
- Validity: 2024-01-17 to 2026-01-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:79:6f:a7:1f:8d:7c:27:46:01:5b:1c:b6:99
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 17 03:25:22 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                29:56:08:CD:3D:2F:B2:DE:C4:EB:B6:B3:CF:84:43:4C:27:3C:FA:5A
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 04E808603BE46B2534562E3DE237F4AE7ABE2B5E3141D8DEC470A822370D3DB7
    SPKI SHA256: EBAD2755CBCD45C16C477B3BA0749C14CC9B6D1E8A890CCF78ABD22BEF832BF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 80E56B0455BAD588BEAE163C8BF82B56
- SHA-256: 8895BECEFC2AE76CB15477345F324BD2B9633CA62EB43BA2FD9C7FDBDB86E73B
- SPKI SHA-256: 18BD7FE152B1863C89E78FEEC927DEC61B014F9A4275A4B256A16CA8E80917C2
- Validity: 2024-04-17 to 2026-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6b:04:55:ba:d5:88:be:ae:16:3c:8b:f8:2b:56
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 17 03:18:20 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                68:7B:B6:0C:89:71:71:8E:97:E2:4D:60:4F:0F:A4:18:A7:53:C7:47
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8895BECEFC2AE76CB15477345F324BD2B9633CA62EB43BA2FD9C7FDBDB86E73B
    SPKI SHA256: 18BD7FE152B1863C89E78FEEC927DEC61B014F9A4275A4B256A16CA8E80917C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2024 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 817CD55987E784856DBA0B08CB6D0431
- SHA-256: FD6060D5E39E21BEADA259590BBAD4F79BD46E7A583D4B294CDD30933804A403
- SPKI SHA-256: 2E832339C6F2B42DBD31666F2619DF9D971A86BF5A3662086F1DF85126266546
- Validity: 2024-07-17 to 2026-07-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:59:87:e7:84:85:6d:ba:0b:08:cb:6d:04:31
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 17 03:10:35 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                68:BA:46:31:75:E6:E9:CF:B1:82:BE:0A:A4:B1:2F:9F:36:99:3A:38
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FD6060D5E39E21BEADA259590BBAD4F79BD46E7A583D4B294CDD30933804A403
    SPKI SHA256: 2E832339C6F2B42DBD31666F2619DF9D971A86BF5A3662086F1DF85126266546
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 EV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 82144188B80EB4CCDB6BC0FDFBBBF13C
- SHA-256: AF52155ACBFAF107DC75E4EF1BDCC0FC141FCCA3DF9CE1875FD224960B7563CC
- SPKI SHA-256: 15AE3017DBC9C0DBA64EB98910AD386A0F6EB9E8240FBE9EACB0B757F643A4F0
- Validity: 2024-10-16 to 2026-10-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:88:b8:0e:b4:cc:db:6b:c0:fd:fb:bb:f1:3c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 16 03:09:05 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:AF:9C:24:82:13:76:27:29:4C:7F:3D:5E:B8:3F:B2:CC:92:5F:4C
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AF52155ACBFAF107DC75E4EF1BDCC0FC141FCCA3DF9CE1875FD224960B7563CC
    SPKI SHA256: 15AE3017DBC9C0DBA64EB98910AD386A0F6EB9E8240FBE9EACB0B757F643A4F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 EV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 82B7654FCF291C285004544848ECF853
- SHA-256: 1E319D113EA6896D37781CCD63C77C019BB6BD585EEFB995BDFDB0111AFC5775
- SPKI SHA-256: E33E7B2EC9814160EA61DF2174EAE162F5E9160B280D6CDEE61D0E9CE06B07CE
- Validity: 2025-01-22 to 2027-01-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:4f:cf:29:1c:28:50:04:54:48:48:ec:f8:53
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 22 04:07:26 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4A:39:71:CD:75:7F:CC:C3:9A:A6:C3:97:D4:0B:50:D0:BB:37:3D:47
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1E319D113EA6896D37781CCD63C77C019BB6BD585EEFB995BDFDB0111AFC5775
    SPKI SHA256: E33E7B2EC9814160EA61DF2174EAE162F5E9160B280D6CDEE61D0E9CE06B07CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 EV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83431C854AADFF48E371C29E699D66B8
- SHA-256: 0ED6D98FB0E497E43895FD5F8BFE3A36FEF4471275FC83DFE2550ABEF90D88A8
- SPKI SHA-256: 104B30AB8C900A098CB56897D5462C56038CC52193477A96C8A0F589E2BA9B3C
- Validity: 2025-04-16 to 2027-04-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:85:4a:ad:ff:48:e3:71:c2:9e:69:9d:66:b8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 16 03:14:58 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                54:90:B1:49:01:91:03:F3:E5:71:4E:B7:D3:9B:F2:F4:CB:FE:24:C4
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0ED6D98FB0E497E43895FD5F8BFE3A36FEF4471275FC83DFE2550ABEF90D88A8
    SPKI SHA256: 104B30AB8C900A098CB56897D5462C56038CC52193477A96C8A0F589E2BA9B3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 EV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83DA86E55034C87AA6AA3BDAAA44B098
- SHA-256: AB52DD2FBD0AD9C42E8F763996C0A9423995250434BECAED131F947E77D75684
- SPKI SHA-256: D9076C0AD236D89E9B68933CD3C2D469A22298E4C6E620761620178595C1B1AB
- Validity: 2025-07-16 to 2027-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:e5:50:34:c8:7a:a6:aa:3b:da:aa:44:b0:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 16 03:07:21 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:3B:10:4A:C9:58:6E:34:16:0C:B5:8E:93:2B:A3:77:9C:B8:2C:83
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AB52DD2FBD0AD9C42E8F763996C0A9423995250434BECAED131F947E77D75684
    SPKI SHA256: D9076C0AD236D89E9B68933CD3C2D469A22298E4C6E620761620178595C1B1AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 EV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8471F44B1B79BF75401779F1FF06FC6D
- SHA-256: 4AAAD9A0D4B1E2BA8D5C571ECCBF5327664FF22EC131DEBBD1D8767F968F6AFB
- SPKI SHA-256: F5F650714D34EA512770431EB9808A941D81832D2E2421DEDFC042DD707701B9
- Validity: 2025-10-15 to 2027-10-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:4b:1b:79:bf:75:40:17:79:f1:ff:06:fc:6d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 15 03:09:58 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9A:B6:41:4C:01:A2:FB:7A:6A:24:BB:DB:CA:A4:0D:DC:CF:7A:F7:4C
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4AAAD9A0D4B1E2BA8D5C571ECCBF5327664FF22EC131DEBBD1D8767F968F6AFB
    SPKI SHA256: F5F650714D34EA512770431EB9808A941D81832D2E2421DEDFC042DD707701B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 85150414F439679F1F3D799DE32F0979
- SHA-256: 9EF94964B445161A7E69380CBCA0001ACA466818E5019AC8F7F75A9ADA910FF3
- SPKI SHA-256: 0BCD71DAE9315C23E25B1CF9BA16C5EA7A35C44B585476083AD860D7B8526FAF
- Validity: 2026-01-21 to 2028-01-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:14:f4:39:67:9f:1f:3d:79:9d:e3:2f:09:79
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 21 03:00:44 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AD:50:4A:80:32:F6:48:BE:C7:06:CC:A4:47:03:DE:37:E4:50:42:D7
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9EF94964B445161A7E69380CBCA0001ACA466818E5019AC8F7F75A9ADA910FF3
    SPKI SHA256: 0BCD71DAE9315C23E25B1CF9BA16C5EA7A35C44B585476083AD860D7B8526FAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 85AC70B85F4A82785230B49E3D29A808
- SHA-256: 8A793687C20B7076E15D8E77AC73DEDFCC355D31FF1D023F5518B8DD503BEF7E
- SPKI SHA-256: 079AC53ED527332D58466811F4A6E60313919C36DFC101033C994F25FA8325C3
- Validity: 2026-04-22 to 2028-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:b8:5f:4a:82:78:52:30:b4:9e:3d:29:a8:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 22 03:00:47 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:79:E4:BA:7E:98:18:76:4E:91:84:24:32:39:04:E4:BD:B0:40:AE
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8A793687C20B7076E15D8E77AC73DEDFCC355D31FF1D023F5518B8DD503BEF7E
    SPKI SHA256: 079AC53ED527332D58466811F4A6E60313919C36DFC101033C994F25FA8325C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8643E54A319807FDD840B2BA8840F505
- SHA-256: 83CF7FA823D8A074FE0C5FCAC27C095A234FAAB5F2EBB1E65E898D70F7EB14F5
- SPKI SHA-256: 24A831850F71FE201A97EF7930469AC6CE89DBB503548D50F754F2315F31A000
- Validity: 2026-07-22 to 2028-07-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:4a:31:98:07:fd:d8:40:b2:ba:88:40:f5:05
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 22 03:27:38 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BB:85:4E:30:CB:D3:D5:FD:58:8D:E4:C7:30:A3:04:4C:69:88:99:14
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 83CF7FA823D8A074FE0C5FCAC27C095A234FAAB5F2EBB1E65E898D70F7EB14F5
    SPKI SHA256: 24A831850F71FE201A97EF7930469AC6CE89DBB503548D50F754F2315F31A000
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 EV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 EV TLS CA H2 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 7A2984FAD5004BD85D23CF642E18D5EB
- SHA-256: 44E683576E1C960D784D17BB2325C25CF1BE4E20470C31D9D73CACED496C95C9
- SPKI SHA-256: 339EC5D169F1CEBBB1C76B242000733376E131CD5715C2793A63CC7E85FFD8AC
- Validity: 2021-06-16 to 2024-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46evtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:84:fa:d5:00:4b:d8:5d:23:cf:64:2e:18:d5:eb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 EV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DE:80:2D:4D:A6:CC:42:6D:38:76:D5:16:A2:1A:A2:97:D5:F5:5D:80
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 44E683576E1C960D784D17BB2325C25CF1BE4E20470C31D9D73CACED496C95C9
    SPKI SHA256: 339EC5D169F1CEBBB1C76B242000733376E131CD5715C2793A63CC7E85FFD8AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas E46 OV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83431CA1D6AA2754123023A4EFF3FE9E
- SHA-256: 47A06D81BAF24C59E2EE4373EDFA00ECDBA9373095001FA74377C9978CB8EB15
- SPKI SHA-256: E34B7412B9FF5D73928A2D4D2921CE8284DC1D634ABCD65D417CAE823C6177D8
- Validity: 2025-04-16 to 2027-06-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46ovtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:a1:d6:aa:27:54:12:30:23:a4:ef:f3:fe:9e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 16 03:15:20 2025 GMT
            Not After : Jun 30 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A7:B5:0A:6C:E5:DF:E2:59:CE:D5:90:11:57:80:FC:54:10:9E:AF:F5
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 47A06D81BAF24C59E2EE4373EDFA00ECDBA9373095001FA74377C9978CB8EB15
    SPKI SHA256: E34B7412B9FF5D73928A2D4D2921CE8284DC1D634ABCD65D417CAE823C6177D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 OV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 83DA86F900F04CEA6EACAAB56EABF28E
- SHA-256: EB6F211BE3FA9891BF41D68A1F6DE5BA92B53889A0149397E9C2229795A8E0F4
- SPKI SHA-256: 3E423E3662F49FE860195E2B764564DF20BA88F83C8611D31F5D5FD4E435D36C
- Validity: 2025-07-16 to 2027-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46ovtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:f9:00:f0:4c:ea:6e:ac:aa:b5:6e:ab:f2:8e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 16 03:07:37 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:A0:86:33:9F:6B:AC:67:9F:2E:47:6C:8F:A8:6D:6E:DA:60:0B:00
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EB6F211BE3FA9891BF41D68A1F6DE5BA92B53889A0149397E9C2229795A8E0F4
    SPKI SHA256: 3E423E3662F49FE860195E2B764564DF20BA88F83C8611D31F5D5FD4E435D36C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas E46 OV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8471F465065A04F0A463DA6E607F1DE9
- SHA-256: 1207B166DA6171A51AEE0E68E4612E747BE7049E85239C8E79003C5FAA95D9A9
- SPKI SHA-256: 7302DAE6441DE92CCF3AE5D10D80A44950DD712F60478F225B1E1E29F9623650
- Validity: 2025-10-15 to 2027-10-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46ovtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:65:06:5a:04:f0:a4:63:da:6e:60:7f:1d:e9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Oct 15 03:10:19 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A8:CB:40:1A:C9:A1:7D:56:55:F9:87:81:8C:38:3B:1E:BD:8D:91:F3
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1207B166DA6171A51AEE0E68E4612E747BE7049E85239C8E79003C5FAA95D9A9
    SPKI SHA256: 7302DAE6441DE92CCF3AE5D10D80A44950DD712F60478F225B1E1E29F9623650
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 OV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8515042DD16110BED20672CF891E741B
- SHA-256: 76E7856C3CFB8F37BBE651B42A05CC144ABA59017616E2819D196D7C7E2F83F5
- SPKI SHA-256: 765DA970EE8BACDEC26060806FC6C642059ECCD91D22284C4BA6DFED6D19BC9E
- Validity: 2026-01-21 to 2028-01-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46ovtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:2d:d1:61:10:be:d2:06:72:cf:89:1e:74:1b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jan 21 03:01:04 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8B:4B:87:73:D2:06:27:7B:B6:91:18:76:2B:DF:5A:5E:8B:81:40:03
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 76E7856C3CFB8F37BBE651B42A05CC144ABA59017616E2819D196D7C7E2F83F5
    SPKI SHA256: 765DA970EE8BACDEC26060806FC6C642059ECCD91D22284C4BA6DFED6D19BC9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 OV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 85AC70D408DB9A348CAB704CADBE28AA
- SHA-256: DDE0B4EAFE7F47C783D7178A420268879A352969057CE8D39DB017CA6AA99B07
- SPKI SHA-256: BBABBD98B2F8C644FD231FC443438706ADF7E0CEB1E34E809506DD66503DF1D0
- Validity: 2026-04-22 to 2028-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46ovtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:d4:08:db:9a:34:8c:ab:70:4c:ad:be:28:aa
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 22 03:01:09 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7C:76:2A:A2:06:35:98:03:21:6A:64:97:27:A2:26:6A:6E:0A:9A:52
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DDE0B4EAFE7F47C783D7178A420268879A352969057CE8D39DB017CA6AA99B07
    SPKI SHA256: BBABBD98B2F8C644FD231FC443438706ADF7E0CEB1E34E809506DD66503DF1D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 OV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 OV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 8643E555E3B15F699077AB2B6DAE7D6F
- SHA-256: E003E3E66F590A02BC89714C821D03C89E3EA2CBCB39BCC22B0048947CB4E35D
- SPKI SHA-256: A44DF283C61CE25EFD16D1B59FED65B662D7B9EF1959526924A5E5B97D4670B0
- Validity: 2026-07-22 to 2028-07-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:55:e3:b1:5f:69:90:77:ab:2b:6d:ae:7d:6f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 22 03:27:48 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 OV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                06:CD:69:46:82:D9:60:54:9F:99:F4:F1:61:F2:94:BE:E8:CC:2F:56
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E003E3E66F590A02BC89714C821D03C89E3EA2CBCB39BCC22B0048947CB4E35D
    SPKI SHA256: A44DF283C61CE25EFD16D1B59FED65B662D7B9EF1959526924A5E5B97D4670B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 Qualified Timestamping CA 2022

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 Qualified Timestamping CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Serial: 7C58A10D2DC2B08B94AAF701627E1DB0
- SHA-256: FE0FC91A867975373ED2872CB3BD3DB708256D7C3A978486AF001CC008C1EBCC
- SPKI SHA-256: 100857DB962AE2C8C1BDA147AF2260D8A8F6DC7A2D15A0110A5705088BBA84DA
- Validity: 2022-05-18 to 2037-05-18
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlase46qualifiedtimestampingca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- CRL DP: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:58:a1:0d:2d:c2:b0:8b:94:aa:f7:01:62:7e:1d:b0
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Validity
            Not Before: May 18 12:00:00 2022 GMT
            Not After : May 18 00:00:00 2037 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 Qualified Timestamping CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C4:27:25:F8:25:BB:80:FC:D6:E3:0E:E7:A9:10:26:7D:42:9D:FA:71
            X509v3 Authority Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamproote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamproote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamproote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: FE0FC91A867975373ED2872CB3BD3DB708256D7C3A978486AF001CC008C1EBCC
    SPKI SHA256: 100857DB962AE2C8C1BDA147AF2260D8A8F6DC7A2D15A0110A5705088BBA84DA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamproote46.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas E46 TimeStamping CA 2022

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas E46 TimeStamping CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Serial: 7DAA6CD8F61A9DDBEF258629D8CAB8CC
- SHA-256: FE7C73361732C6C64739FA83A1D7C781EE1AEA990A605AD2FC72FB9586A452FC
- SPKI SHA-256: 8DDD7099627F6E8BE628A8B44BE0168DD0F5604808B6043857C296A3C6EE11C9
- Validity: 2022-12-07 to 2039-12-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- CRL DP: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:aa:6c:d8:f6:1a:9d:db:ef:25:86:29:d8:ca:b8:cc
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Validity
            Not Before: Dec  7 03:32:56 2022 GMT
            Not After : Dec  7 00:00:00 2039 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas E46 TimeStamping CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E0:36:44:5D:47:87:C0:BF:34:5B:AB:EC:CE:D6:E5:96:C6:D3:9E:1E
            X509v3 Authority Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamproote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamproote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamproote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.2
                Policy: 1.3.6.1.4.1.4146.1.30
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: FE7C73361732C6C64739FA83A1D7C781EE1AEA990A605AD2FC72FB9586A452FC
    SPKI SHA256: 8DDD7099627F6E8BE628A8B44BE0168DD0F5604808B6043857C296A3C6EE11C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamproote46.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV ACME CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB337260870BA42B63C0F7989EE9A9
- SHA-256: A262F7D653E6C745EEABEBF6672A756B501A82F06708F2B5E77916217037BBCA
- SPKI SHA-256: 2F8CB4CA01D4170B87072A2DF71A67FD10EE5B37F440DD1974811B3E46250A74
- Validity: 2021-10-20 to 2024-10-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:72:60:87:0b:a4:2b:63:c0:f7:98:9e:e9:a9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D1:80:3E:D3:C2:CB:E2:D0:3D:07:00:AC:D4:81:B4:91:78:89:44:AA
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A262F7D653E6C745EEABEBF6672A756B501A82F06708F2B5E77916217037BBCA
    SPKI SHA256: 2F8CB4CA01D4170B87072A2DF71A67FD10EE5B37F440DD1974811B3E46250A74
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41EAEAFACDD5CF31E45F43483E58
- SHA-256: 7B063A9CD48767C475AA6BCED4667CDC56068F8B7B895125BC4EB24682EEB606
- SPKI SHA-256: 42014B9387D4E56229B002219D7434F5C3758DC78AAA678DC15D5016353E847B
- Validity: 2022-01-26 to 2025-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:ea:ea:fa:cd:d5:cf:31:e4:5f:43:48:3e:58
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:1E:14:2A:8A:BD:D0:A8:60:0A:93:19:45:8D:CD:25:57:E7:43:B7
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7B063A9CD48767C475AA6BCED4667CDC56068F8B7B895125BC4EB24682EEB606
    SPKI SHA256: 42014B9387D4E56229B002219D7434F5C3758DC78AAA678DC15D5016353E847B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C13585F66FDABDF1433F63DD87C
- SHA-256: A8B2A4518A82A0CC0A60B2FB88B946557ADB4FA58458EC7680A77BB0E5334D8D
- SPKI SHA-256: 4DEBC5E6884C1357FEB5249FB951A51814BBDC1F589A902210708C4827C7788C
- Validity: 2022-04-20 to 2025-04-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:13:58:5f:66:fd:ab:df:14:33:f6:3d:d8:7c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:8E:5D:24:70:42:34:6F:E4:28:6D:26:DE:73:88:35:02:B1:22:C7
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A8B2A4518A82A0CC0A60B2FB88B946557ADB4FA58458EC7680A77BB0E5334D8D
    SPKI SHA256: 4DEBC5E6884C1357FEB5249FB951A51814BBDC1F589A902210708C4827C7788C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174C60E9DACCB892169473240A11B
- SHA-256: 649BFB0BAA0E25655EDB410B6B6E073D5670E00CB76F390BD97EB26ACC0AA44A
- SPKI SHA-256: 9D4EC4C0FB9D088E6B5F1B9F8B7B7BB6973BD1DA7CD0EDD9A2D335013EF29163
- Validity: 2022-07-20 to 2024-07-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:c6:0e:9d:ac:cb:89:21:69:47:32:40:a1:1b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:32 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A7:1E:E3:AC:38:C7:0E:73:8A:03:DF:C0:26:F9:70:81:34:CB:E7:F9
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 649BFB0BAA0E25655EDB410B6B6E073D5670E00CB76F390BD97EB26ACC0AA44A
    SPKI SHA256: 9D4EC4C0FB9D088E6B5F1B9F8B7B7BB6973BD1DA7CD0EDD9A2D335013EF29163
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D423AB4FEE5D19C63A99A51F75568
- SHA-256: 8CFDFAE1C0606B8E381AE6A2D4AFD1E50CEA63B652C2CB7314561D3353183369
- SPKI SHA-256: 3349F9D3833B777A84315B7E4B1C8D38720405649EE75386B021BF34A03D1D0B
- Validity: 2022-10-12 to 2024-10-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:3a:b4:fe:e5:d1:9c:63:a9:9a:51:f7:55:68
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:16 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A5:A1:BE:3A:74:4F:49:93:18:1B:0F:C4:B2:5B:3D:84:46:5C:4D:1C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8CFDFAE1C0606B8E381AE6A2D4AFD1E50CEA63B652C2CB7314561D3353183369
    SPKI SHA256: 3349F9D3833B777A84315B7E4B1C8D38720405649EE75386B021BF34A03D1D0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF051523186403A0DB64DA1CCDCBB25
- SHA-256: F5CA53D8790D2AC5E1275D2E10DD914A924F2004951144FB8C73556163A2652E
- SPKI SHA-256: 3B346A4BE8612D76F5D22AC2AA44441A38286428BF2F50249A87E461DEF4EFE4
- Validity: 2023-01-18 to 2025-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:52:31:86:40:3a:0d:b6:4d:a1:cc:dc:bb:25
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:41 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FD:6B:07:07:B1:77:47:AE:E5:5E:25:BA:8C:72:53:4F:58:A1:F6:8C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F5CA53D8790D2AC5E1275D2E10DD914A924F2004951144FB8C73556163A2652E
    SPKI SHA256: 3B346A4BE8612D76F5D22AC2AA44441A38286428BF2F50249A87E461DEF4EFE4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C29C6F915246EA2C43F5D1D767A5
- SHA-256: 97AFE7C35378C386837676A134D7A1D472B72EF091F224F9986C8256A6D75296
- SPKI SHA-256: B84F958A305FF6C00AF5FF49FA2C54CF2846F7B2C6D635D407BFF1B296D7D072
- Validity: 2023-04-19 to 2025-04-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:9c:6f:91:52:46:ea:2c:43:f5:d1:d7:67:a5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:27 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0E:54:17:BB:5F:58:38:22:BB:76:CB:53:E1:9A:4C:9D:EE:3F:5A:B4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 97AFE7C35378C386837676A134D7A1D472B72EF091F224F9986C8256A6D75296
    SPKI SHA256: B84F958A305FF6C00AF5FF49FA2C54CF2846F7B2C6D635D407BFF1B296D7D072
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C438517EA72A202F21C2479143E
- SHA-256: D786D22A7BD61D06A68586376DC1226063592F4D864AC4E7BDAE40AFB62238DD
- SPKI SHA-256: 71228F497A19975706874E913D7C6EAC42A3190ABF2BF74A40202532E086E25D
- Validity: 2023-07-19 to 2025-07-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:43:85:17:ea:72:a2:02:f2:1c:24:79:14:3e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:24 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2F:08:72:65:B1:71:4C:28:CD:24:E9:C4:3F:7A:83:0E:05:58:42:03
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D786D22A7BD61D06A68586376DC1226063592F4D864AC4E7BDAE40AFB62238DD
    SPKI SHA256: 71228F497A19975706874E913D7C6EAC42A3190ABF2BF74A40202532E086E25D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0E2AC5607B7F97CF07EC513DE91
- SHA-256: 3C1B0BEFF052EC90997A72352E7D3DAAF90746B9A3C4D8987A5BBB9D0370E4B0
- SPKI SHA-256: 4322676F03E894F3BFF765735ED11164521E7C265B2CA55027600B8AD4670181
- Validity: 2023-10-18 to 2025-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:e2:ac:56:07:b7:f9:7c:f0:7e:c5:13:de:91
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:26 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E3:C6:CF:95:D9:E5:AB:CB:85:6C:AE:1A:07:C6:F3:1B:40:D2:6D:C5
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3C1B0BEFF052EC90997A72352E7D3DAAF90746B9A3C4D8987A5BBB9D0370E4B0
    SPKI SHA256: 4322676F03E894F3BFF765735ED11164521E7C265B2CA55027600B8AD4670181
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E0031C401049CF37BE7D5A6BB1DA9
- SHA-256: 3B74D815D0ADD8BA412A3766C805E4F11F946943BE8F18A9D197B526FB4206BC
- SPKI SHA-256: 4EA6B083DF346C49959A5729AC3473B16090695492032857A9364A2E2C685096
- Validity: 2024-01-17 to 2026-01-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:31:c4:01:04:9c:f3:7b:e7:d5:a6:bb:1d:a9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:25 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D1:57:ED:F2:7E:15:F2:6C:7D:06:53:D9:82:50:1B:74:0E:20:E3:79
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3B74D815D0ADD8BA412A3766C805E4F11F946943BE8F18A9D197B526FB4206BC
    SPKI SHA256: 4EA6B083DF346C49959A5729AC3473B16090695492032857A9364A2E2C685096
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56ABDED69883EB36A4ABAA9B74A53
- SHA-256: 381CCD1DCD9BB6047EDA2550CF1919493258DCEFB7E87B594DD4440CCBA400E2
- SPKI SHA-256: A366FEE8B8C8CA8FB9A1CCD1AA6AF6834CA7D3861F0269CC15D2F7DE50C1FD08
- Validity: 2024-04-17 to 2026-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:bd:ed:69:88:3e:b3:6a:4a:ba:a9:b7:4a:53
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:24 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8D:EE:9A:A9:7B:63:14:5D:76:B2:36:A6:02:05:3D:9E:08:EB:5D:B6
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 381CCD1DCD9BB6047EDA2550CF1919493258DCEFB7E87B594DD4440CCBA400E2
    SPKI SHA256: A366FEE8B8C8CA8FB9A1CCD1AA6AF6834CA7D3861F0269CC15D2F7DE50C1FD08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD508006518346D7103A9BD5BED59
- SHA-256: 43243DBE88A2A57F41DB22DE5E31836444AFCF41A6B9E38D01403413C276FF3D
- SPKI SHA-256: B15E1D11B3AD300D7CD74884C44B87FFDC83710E8370283A7384C664F6C0792A
- Validity: 2024-07-17 to 2026-07-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:08:00:65:18:34:6d:71:03:a9:bd:5b:ed:59
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:30 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FF:81:9E:9E:8B:8D:68:67:CF:7B:7F:98:35:8F:DE:25:10:C3:AC:BC
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 43243DBE88A2A57F41DB22DE5E31836444AFCF41A6B9E38D01403413C276FF3D
    SPKI SHA256: B15E1D11B3AD300D7CD74884C44B87FFDC83710E8370283A7384C664F6C0792A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8214412C227304759708E1C871A3583F
- SHA-256: D6A2012D797591CDE8C7EA0DD06A3803062C66159F52071EF087F06F9CB394FE
- SPKI SHA-256: E95B95FE17A4F0B6B654CA17017AEF1BF95939CBAB327A4C7525E5A0BE93F340
- Validity: 2024-10-16 to 2026-10-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:2c:22:73:04:75:97:08:e1:c8:71:a3:58:3f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:07:52 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7C:77:2C:79:AC:91:87:AE:5C:C2:7B:F7:51:DF:A0:03:8F:B4:73:E4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D6A2012D797591CDE8C7EA0DD06A3803062C66159F52071EF087F06F9CB394FE
    SPKI SHA256: E95B95FE17A4F0B6B654CA17017AEF1BF95939CBAB327A4C7525E5A0BE93F340
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV ACME CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B764FA152E8C784F4F91FD5647EF19
- SHA-256: F4EDDB1F34C43E83EB01A9E5330218B8E5C16B08B3DCAA884A796E4F4669C079
- SPKI SHA-256: 6578673C2182458E92F7797D379146C5BB9F4EABB44ABF9A92F35A957233FB13
- Validity: 2025-01-22 to 2027-01-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmeca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:64:fa:15:2e:8c:78:4f:4f:91:fd:56:47:ef:19
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:18 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F6:6F:BF:B6:A1:81:E2:22:28:B9:B6:2D:26:E1:5E:39:00:F2:7F:D8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F4EDDB1F34C43E83EB01A9E5330218B8E5C16B08B3DCAA884A796E4F4669C079
    SPKI SHA256: 6578673C2182458E92F7797D379146C5BB9F4EABB44ABF9A92F35A957233FB13
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV ACME CA H1 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA H1 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79299AB34A10700331EAAF2D2686BF35
- SHA-256: E7757BB0C4942ADC108D092A17B812B1043E06A094DD5E214920325556FC6924
- SPKI SHA-256: 574C4D765C499470379507663E99C9813C1B9B7E67E574DACD17BEFE884948DC
- Validity: 2021-02-24 to 2024-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmecah12021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9a:b3:4a:10:70:03:31:ea:af:2d:26:86:bf:35
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 24 00:00:00 2021 GMT
            Not After : Feb 24 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA H1 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:7E:DA:52:B8:75:54:42:E7:22:3E:CE:31:F8:B2:20:C7:29:55:DF
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E7757BB0C4942ADC108D092A17B812B1043E06A094DD5E214920325556FC6924
    SPKI SHA256: 574C4D765C499470379507663E99C9813C1B9B7E67E574DACD17BEFE884948DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV ACME CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV ACME CA H2 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A2984FFE0A0A0F5ACD23C5830239EF0
- SHA-256: 61B30CEAEA0C8C6397C3599829809CB73CA8F817BB9CDF000D7453E442438028
- SPKI SHA-256: 3774F4D54ACFFECCE8A59FBE50BC0F0BD32EAAE4D2B677CCDBC6E12CAB99D6B6
- Validity: 2021-06-16 to 2024-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvacmecah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:84:ff:e0:a0:a0:f5:ac:d2:3c:58:30:23:9e:f0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV ACME CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                67:CD:F1:85:EF:E5:54:CA:D1:3C:19:CD:5D:B3:C9:C5:C7:5A:7E:86
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 61B30CEAEA0C8C6397C3599829809CB73CA8F817BB9CDF000D7453E442438028
    SPKI SHA256: 3774F4D54ACFFECCE8A59FBE50BC0F0BD32EAAE4D2B677CCDBC6E12CAB99D6B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2020
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031AA50ABB6EBC85CAAAE88D642F60
- SHA-256: 72132ECF2F8C75B5F214C00ED14562E14912B7F2F4D2633180F3E4918980FEC4
- SPKI SHA-256: 76F4C48C3F7546B67C3B7F4C316F6E329DC1B11A71971E515B32F4BE6A094727
- Validity: 2020-08-19 to 2030-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:a5:0a:bb:6e:bc:85:ca:aa:e8:8d:64:2f:60
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Aug 19 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                40:D8:66:C8:9E:EB:7B:12:B2:EA:30:48:33:43:89:20:E1:17:B0:13
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 72132ECF2F8C75B5F214C00ED14562E14912B7F2F4D2633180F3E4918980FEC4
    SPKI SHA256: 76F4C48C3F7546B67C3B7F4C316F6E329DC1B11A71971E515B32F4BE6A094727
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV TLS CA 2020-12

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2020-12
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA85630497316C8EDF54E5721B66
- SHA-256: 6F335DD7CD4AAA1D9140F290E9E7B3498A7CC35A244AA300E146BA2D9D02B960
- SPKI SHA-256: 57F2B6567ABE406E4383F958A7E1677E0B4C1AFB4B619D6A01F62D90A40020B8
- Validity: 2020-12-09 to 2022-12-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca202012.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:85:63:04:97:31:6c:8e:df:54:e5:72:1b:66
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec  9 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2020-12
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C7:1D:C2:27:62:6B:AE:06:7A:DC:85:F9:4E:8B:C5:EC:59:89:17:08
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6F335DD7CD4AAA1D9140F290E9E7B3498A7CC35A244AA300E146BA2D9D02B960
    SPKI SHA256: 57F2B6567ABE406E4383F958A7E1677E0B4C1AFB4B619D6A01F62D90A40020B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB338A741A09E601CD9A8DB82E4309
- SHA-256: 727A9069A3C60D213584E616D5BF55DFD19C71A3976645EA6A73B18F83760D24
- SPKI SHA-256: A98B9CF2CA0F3F9B2B2DAFE0579ABE384F43B62749E67B55362A0960E82A4462
- Validity: 2021-10-20 to 2024-10-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:8a:74:1a:09:e6:01:cd:9a:8d:b8:2e:43:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                95:F0:E6:26:4C:08:C1:A3:1B:19:E5:42:1D:7D:A9:EC:30:66:FD:DA
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 727A9069A3C60D213584E616D5BF55DFD19C71A3976645EA6A73B18F83760D24
    SPKI SHA256: A98B9CF2CA0F3F9B2B2DAFE0579ABE384F43B62749E67B55362A0960E82A4462
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E42015CE902D278045D32B34B14EA
- SHA-256: 15B63CDD772A8D42DC5E48174C1F7E3D40FC82C478DF3A6443C7BD92FBC6D5DE
- SPKI SHA-256: 5E3E7C1E16426698A666D504C452A062CD928F5B3D964CE2D27BDC6E17F11BC3
- Validity: 2022-01-26 to 2025-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:01:5c:e9:02:d2:78:04:5d:32:b3:4b:14:ea
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:28:84:DF:1D:F6:19:62:51:0E:AD:A9:5A:E6:60:B6:CF:F8:F3:F8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 15B63CDD772A8D42DC5E48174C1F7E3D40FC82C478DF3A6443C7BD92FBC6D5DE
    SPKI SHA256: 5E3E7C1E16426698A666D504C452A062CD928F5B3D964CE2D27BDC6E17F11BC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C2C10F4136771A0CFEE70CAEE72
- SHA-256: E6C18D6D008C712B3017DE1AE7659418983254B01DE4895AE91F3B29FF482417
- SPKI SHA-256: D4E538BF847D7215801E85BBFCBBEA9B4596FFAF1B57FA2443C56755FEB34166
- Validity: 2022-04-20 to 2025-04-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:2c:10:f4:13:67:71:a0:cf:ee:70:ca:ee:72
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C6:07:EA:E1:56:40:46:6C:35:9E:97:21:2B:E2:B0:66:1F:BE:BC:C6
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E6C18D6D008C712B3017DE1AE7659418983254B01DE4895AE91F3B29FF482417
    SPKI SHA256: D4E538BF847D7215801E85BBFCBBEA9B4596FFAF1B57FA2443C56755FEB34166
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174D71A1AE5C423A6A4121D556270
- SHA-256: 710DE4D226429E1657C15042B3F404DE5BF6DEBFE00F77DFD671AEC67A374E48
- SPKI SHA-256: 24EACA8FEA19A528239D04EA21BCA9643FCC266928B795633522C6FD826F215A
- Validity: 2022-07-20 to 2024-07-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:d7:1a:1a:e5:c4:23:a6:a4:12:1d:55:62:70
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:45 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                75:72:FA:1F:91:E3:FE:63:00:B7:7F:04:6A:3C:84:A2:E7:3B:B0:D4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 710DE4D226429E1657C15042B3F404DE5BF6DEBFE00F77DFD671AEC67A374E48
    SPKI SHA256: 24EACA8FEA19A528239D04EA21BCA9643FCC266928B795633522C6FD826F215A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D42555F125BF9D133479365F73B73
- SHA-256: 4C41707D884D7E7D3FDE3DF7C24C7FF6E46F9166651D82C3DA7C4798D7A0824F
- SPKI SHA-256: DFA6A1ED61DDC7693D1B6961D4475CB2BEA5563491E87FE7ED1EC559FE720313
- Validity: 2022-10-12 to 2024-10-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:55:5f:12:5b:f9:d1:33:47:93:65:f7:3b:73
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:37 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E3:BD:38:4A:67:BA:E7:E3:18:44:C5:D6:48:85:DD:69:E9:0F:00:04
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4C41707D884D7E7D3FDE3DF7C24C7FF6E46F9166651D82C3DA7C4798D7A0824F
    SPKI SHA256: DFA6A1ED61DDC7693D1B6961D4475CB2BEA5563491E87FE7ED1EC559FE720313
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF0516A8BCDD9ABA74AF18C08A25DDC
- SHA-256: 86E5811AF6678C23FE7133CC92A27E93CFB85682BE0C2954575E7A4D06285598
- SPKI SHA-256: 21463D395FC40C5EA0B9B1DEE489116247BEF1041D709EA8BDEBB553E3320939
- Validity: 2023-01-18 to 2025-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:6a:8b:cd:d9:ab:a7:4a:f1:8c:08:a2:5d:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:37:00 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:F2:CC:14:C8:C3:BB:20:C1:23:7C:2F:6F:93:96:96:83:AB:B2:98
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 86E5811AF6678C23FE7133CC92A27E93CFB85682BE0C2954575E7A4D06285598
    SPKI SHA256: 21463D395FC40C5EA0B9B1DEE489116247BEF1041D709EA8BDEBB553E3320939
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2A95532A47290782A16A38C6FBC
- SHA-256: FC2811137DC86C7987D5665E22AC4A2741CE54B623DC58E80CE90EF8626F67FC
- SPKI SHA-256: 0EBB3A09C16C151FFFD36065F2C1EE86553B079CBAA7BE0A856924F7A6347D10
- Validity: 2023-04-19 to 2025-04-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:a9:55:32:a4:72:90:78:2a:16:a3:8c:6f:bc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:37 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:B0:DE:53:F5:E7:56:82:0E:8F:07:DD:1B:5C:FD:87:ED:B5:F4:10
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FC2811137DC86C7987D5665E22AC4A2741CE54B623DC58E80CE90EF8626F67FC
    SPKI SHA256: 0EBB3A09C16C151FFFD36065F2C1EE86553B079CBAA7BE0A856924F7A6347D10
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C5194BDB89C163ADA24E0D4823C
- SHA-256: C5AC82D56F3DABBC7D2790FFBD4CD6BE07572CE47ADE456DB30FC48E60352CFD
- SPKI SHA-256: 172E761B89486F7BA6A39C6247CA206B94545E3A9E9792EBCB83EF39D039F3F7
- Validity: 2023-07-19 to 2025-07-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:51:94:bd:b8:9c:16:3a:da:24:e0:d4:82:3c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:35 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E2:F4:DC:DD:6E:04:5D:F6:2A:06:92:A5:81:CD:DE:B0:E3:54:4D:75
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C5AC82D56F3DABBC7D2790FFBD4CD6BE07572CE47ADE456DB30FC48E60352CFD
    SPKI SHA256: 172E761B89486F7BA6A39C6247CA206B94545E3A9E9792EBCB83EF39D039F3F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0F80279A1A5AC766C8467AB5E08
- SHA-256: A79831D06B05530A5533526EAD1EF6E0D7FFA2BC52D59EEFB41B950AECC31CDB
- SPKI SHA-256: A7CB582B7BE3ECB817F18CA68CAF5789FF9B9CE231A90C87A4436326EEB4F490
- Validity: 2023-10-18 to 2025-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:f8:02:79:a1:a5:ac:76:6c:84:67:ab:5e:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:43 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                02:12:01:8D:69:B9:7C:83:61:DE:DB:0F:02:56:05:56:32:E9:48:E8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A79831D06B05530A5533526EAD1EF6E0D7FFA2BC52D59EEFB41B950AECC31CDB
    SPKI SHA256: A7CB582B7BE3ECB817F18CA68CAF5789FF9B9CE231A90C87A4436326EEB4F490
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E00418FE45EBB2084E72328B921AA
- SHA-256: D3E722A0520E72F756FDE9BDDF3D5649F6A85A40CABDCC937F77700A7C45E2FC
- SPKI SHA-256: D8BD6473B57ABB558E262A45E73B7668E58422F33F9A9420445A2E271B153EA3
- Validity: 2024-01-17 to 2026-01-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:41:8f:e4:5e:bb:20:84:e7:23:28:b9:21:aa
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:38 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                ED:02:0E:57:91:6E:7A:3E:9A:11:54:EA:F5:4C:7A:65:1E:29:A4:B5
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D3E722A0520E72F756FDE9BDDF3D5649F6A85A40CABDCC937F77700A7C45E2FC
    SPKI SHA256: D8BD6473B57ABB558E262A45E73B7668E58422F33F9A9420445A2E271B153EA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56ACC72F741951320577AF967511C
- SHA-256: 714345A66D06D325CFE05E0626C039AD8101693BD470BC4E95D874FD480A2261
- SPKI SHA-256: 156BF2308E2624E9E1CFFFD8DA94854F98D67DBAF475641EFA8F6AE1061B542F
- Validity: 2024-04-17 to 2026-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:cc:72:f7:41:95:13:20:57:7a:f9:67:51:1c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:35 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F9:2F:B3:9A:F1:E6:BD:44:D5:EF:43:C5:9D:8F:DE:37:5F:47:57:54
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 714345A66D06D325CFE05E0626C039AD8101693BD470BC4E95D874FD480A2261
    SPKI SHA256: 156BF2308E2624E9E1CFFFD8DA94854F98D67DBAF475641EFA8F6AE1061B542F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD5227FA9BF065E1972A502EF9909
- SHA-256: 513CA66A94979F93E442B6B20738CAE804914FBCBC69441A9E03A10636937039
- SPKI SHA-256: 536200A5B6B40E5EC47C9ACD1C771CD7F202938D4D0E2C5D84AEE86461A0386C
- Validity: 2024-07-17 to 2026-07-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:22:7f:a9:bf:06:5e:19:72:a5:02:ef:99:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:51 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FD:0A:3E:B6:07:9B:F0:12:94:3A:AB:02:71:C1:18:AA:FE:A1:E9:A4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 513CA66A94979F93E442B6B20738CAE804914FBCBC69441A9E03A10636937039
    SPKI SHA256: 536200A5B6B40E5EC47C9ACD1C771CD7F202938D4D0E2C5D84AEE86461A0386C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 DV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82144146A7F36A66332378C0EDFBBD7E
- SHA-256: F0E7B17ECABA37C6029E2ACC032DFCDF2A9A75B19EFA8C220110C37F719F327D
- SPKI SHA-256: E034CE23DCD9F327E58EDD551D3CA1DF3BC3A9F66EAEED6D06F356C7B42B3254
- Validity: 2024-10-16 to 2026-10-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:46:a7:f3:6a:66:33:23:78:c0:ed:fb:bd:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:08:13 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D2:6C:2B:F0:32:B2:01:D9:13:6A:61:B9:49:7D:A1:1B:00:3C:FA:C3
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F0E7B17ECABA37C6029E2ACC032DFCDF2A9A75B19EFA8C220110C37F719F327D
    SPKI SHA256: E034CE23DCD9F327E58EDD551D3CA1DF3BC3A9F66EAEED6D06F356C7B42B3254
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B765107282A881F4ACDB7D437BB49C
- SHA-256: ADFCE41D4E699C1DD778CB5A0F5B41AB8A80016D19584DC94C23AFAF2D6E3866
- SPKI SHA-256: C1E13FBA9C5513D9212ACF4F90AD3F904F793C88D8A3CB339AB02813219A1924
- Validity: 2025-01-22 to 2027-01-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:10:72:82:a8:81:f4:ac:db:7d:43:7b:b4:9c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:36 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EC:89:1D:CC:3C:40:62:40:5C:98:31:FB:30:AA:1D:70:9B:9C:A0:F6
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ADFCE41D4E699C1DD778CB5A0F5B41AB8A80016D19584DC94C23AFAF2D6E3866
    SPKI SHA256: C1E13FBA9C5513D9212ACF4F90AD3F904F793C88D8A3CB339AB02813219A1924
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C543E383ECDFE1DAC48CB4E29D8
- SHA-256: 988B137CDCD3832F98FBDA08D471C71B442FE92502B66B837700D8C4F07CBF34
- SPKI SHA-256: 8B0CF57D8DCDE986BFC8FC2FB5F53CDC9B70F4DA09EF2E44E74C54AC5314EB93
- Validity: 2025-04-16 to 2027-04-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:54:3e:38:3e:cd:fe:1d:ac:48:cb:4e:29:d8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:14:19 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5C:36:A9:12:47:B6:6B:BC:FE:80:35:BF:1F:48:77:A5:3C:D1:FD:77
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 988B137CDCD3832F98FBDA08D471C71B442FE92502B66B837700D8C4F07CBF34
    SPKI SHA256: 8B0CF57D8DCDE986BFC8FC2FB5F53CDC9B70F4DA09EF2E44E74C54AC5314EB93
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA86B9E88456E9397114415F852391
- SHA-256: 94EBE958A2443AB50F8E18C59BF7ED64E671E8D1FD6D96C1BCEBF664739E9AF7
- SPKI SHA-256: 1D4140F042062CFC49F952C57380990678BD2CE8BF1074A7A8600BA07BDF08FC
- Validity: 2025-07-16 to 2027-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:b9:e8:84:56:e9:39:71:14:41:5f:85:23:91
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:06:47 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:98:26:C4:BA:20:F8:6A:97:54:0C:B5:F3:FD:D9:0C:80:CE:C1:28
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 94EBE958A2443AB50F8E18C59BF7ED64E671E8D1FD6D96C1BCEBF664739E9AF7
    SPKI SHA256: 1D4140F042062CFC49F952C57380990678BD2CE8BF1074A7A8600BA07BDF08FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 DV TLS CA 2026 LT

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 LT
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8643E5619031356A503B17D09A6822FD
- SHA-256: CD211284C36CA8AD0BB567E6F4EF601F39D4AE90DC25F1C66084C18D3CC2C4F3
- SPKI SHA-256: DE3A743464A6620B0FD255FC596943DA0083ABF3C907CA508563ACC33F3D8A51
- Validity: 2026-07-22 to 2029-07-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:61:90:31:35:6a:50:3b:17:d0:9a:68:22:fd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 22 03:27:57 2026 GMT
            Not After : Jul 21 12:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2026 LT
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:54:A9:D0:C8:A3:DF:30:53:EF:51:8D:74:27:86:09:A8:09:8C:3E
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CD211284C36CA8AD0BB567E6F4EF601F39D4AE90DC25F1C66084C18D3CC2C4F3
    SPKI SHA256: DE3A743464A6620B0FD255FC596943DA0083ABF3C907CA508563ACC33F3D8A51
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F41BE78EE32F6C1A3D03323BC357
- SHA-256: DE517C8516F8445DC4F42F702F0B0FA6E68BF3A50AF05898D01F71CCB0CEE7C3
- SPKI SHA-256: 13565BD9DEE08392F5F30D3F8DDBA0B28AC051970D1F061BD001682C5F1F1492
- Validity: 2025-10-15 to 2027-10-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:1b:e7:8e:e3:2f:6c:1a:3d:03:32:3b:c3:57
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:09:21 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:A1:0D:CF:AC:AE:45:6A:98:29:A9:07:01:29:C5:D3:23:26:33:8C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DE517C8516F8445DC4F42F702F0B0FA6E68BF3A50AF05898D01F71CCB0CEE7C3
    SPKI SHA256: 13565BD9DEE08392F5F30D3F8DDBA0B28AC051970D1F061BD001682C5F1F1492
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 851503E672E9C2A4766809FA4326BAB5
- SHA-256: 27F076EE106366865F56B43042F735D96B2C5E83C68F9367917639CADFEDCD16
- SPKI SHA-256: 2A39A891A5D82DF3E6AD55BCD19C61EFDE404C95BC01102917D0A5DB8467FA7F
- Validity: 2026-01-21 to 2028-01-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:e6:72:e9:c2:a4:76:68:09:fa:43:26:ba:b5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 03:00:07 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:F0:29:E4:F6:BB:C4:BB:3B:93:CB:4C:14:81:3E:74:97:86:F6:E7
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 27F076EE106366865F56B43042F735D96B2C5E83C68F9367917639CADFEDCD16
    SPKI SHA256: 2A39A891A5D82DF3E6AD55BCD19C61EFDE404C95BC01102917D0A5DB8467FA7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC708DE395EC0C897DA9D30145EE7E
- SHA-256: 52B73E57665B6586A6515610580DE1ECB1E4C75067FB2B4BE9B5515D606C67F6
- SPKI SHA-256: 07EDEFFEAF595B789490EAF6E97A8C329D48008915689C52D74AFE2D58232695
- Validity: 2026-04-22 to 2028-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:8d:e3:95:ec:0c:89:7d:a9:d3:01:45:ee:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 03:00:13 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:33:9D:52:CB:6B:CE:FB:E8:9A:B5:21:32:33:8C:AB:17:E4:A8:3D
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 52B73E57665B6586A6515610580DE1ECB1E4C75067FB2B4BE9B5515D606C67F6
    SPKI SHA256: 07EDEFFEAF595B789490EAF6E97A8C329D48008915689C52D74AFE2D58232695
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 DV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 DV TLS CA H2 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A298504FCB996A6208F9E0698ECE9C3
- SHA-256: 6916DA916EE1B1E98CB31EE94730EECD7F2C077965BDB8D4E16A3B81C58A29B6
- SPKI SHA-256: EBE8354D42570F45A1634D5D95301C1538BA475CFE2F85CFE293E02555131DF0
- Validity: 2021-06-16 to 2024-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5dvtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:04:fc:b9:96:a6:20:8f:9e:06:98:ec:e9:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 DV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C8:21:9B:F7:8A:36:14:D9:23:D0:45:AB:1B:DB:70:8F:B0:02:11:A6
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6916DA916EE1B1E98CB31EE94730EECD7F2C077965BDB8D4E16A3B81C58A29B6
    SPKI SHA256: EBE8354D42570F45A1634D5D95301C1538BA475CFE2F85CFE293E02555131DF0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB337775575AB47DD18117E332B886
- SHA-256: 218C470B78B02D39B84FC6892F5A1FE9C99D6B9A6B8B7471E039EDCFCA91004C
- SPKI SHA-256: B649D0952F3185D272E2F56ECB63BCFF841B7757722C539B8D37665BC7384A41
- Validity: 2021-10-20 to 2024-10-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:77:75:57:5a:b4:7d:d1:81:17:e3:32:b8:86
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                19:C6:7D:10:99:31:77:BF:7F:E7:82:42:78:C1:05:26:D7:A4:28:9A
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 218C470B78B02D39B84FC6892F5A1FE9C99D6B9A6B8B7471E039EDCFCA91004C
    SPKI SHA256: B649D0952F3185D272E2F56ECB63BCFF841B7757722C539B8D37665BC7384A41
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41EFDF5F8DB1AF66A4B82B0B816C
- SHA-256: CB2C685CB214DCD2F2CDA6E2C155AAF21A7E134BC0BCE808B1130C459125B0A4
- SPKI SHA-256: 61353338B770B620995C4F0038FB356FA61B0DAD69FC4AD3D31959537EF9D971
- Validity: 2022-01-26 to 2025-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:ef:df:5f:8d:b1:af:66:a4:b8:2b:0b:81:6c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5F:9C:14:AF:66:53:66:95:2D:46:AC:64:13:E9:84:35:3E:87:98:40
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CB2C685CB214DCD2F2CDA6E2C155AAF21A7E134BC0BCE808B1130C459125B0A4
    SPKI SHA256: 61353338B770B620995C4F0038FB356FA61B0DAD69FC4AD3D31959537EF9D971
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C195E7A8ECF07E48C94EEB33BDC
- SHA-256: E4C2D8C6E54ECE1C996A305972B1AE0B064F105BE06CFD7295FD2DAE33B97E1A
- SPKI SHA-256: 8A923FBEFA0F6B356F11D0E7F65F1F158E2378AB6FB9949F5AEB450AED642249
- Validity: 2022-04-20 to 2025-04-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:19:5e:7a:8e:cf:07:e4:8c:94:ee:b3:3b:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:BE:37:0A:99:18:08:CC:15:E6:BE:0B:22:64:7F:4A:66:78:38:13
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E4C2D8C6E54ECE1C996A305972B1AE0B064F105BE06CFD7295FD2DAE33B97E1A
    SPKI SHA256: 8A923FBEFA0F6B356F11D0E7F65F1F158E2378AB6FB9949F5AEB450AED642249
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174C9B1D30DB74C84D378D0EBE7BF
- SHA-256: C7AC7C5B8162E0F0931D1B2F7740C2284FF1595C10E82DB1EE3A1258F0A7406F
- SPKI SHA-256: A20E0B68402D5BEB16A8A85763B447C07D047DDDBD5C9AF21159546852FAE427
- Validity: 2022-07-20 to 2024-07-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:c9:b1:d3:0d:b7:4c:84:d3:78:d0:eb:e7:bf
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:35 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F5:EE:6E:53:EF:67:69:C1:43:72:D0:44:89:51:EF:A6:D8:C8:B5:B2
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C7AC7C5B8162E0F0931D1B2F7740C2284FF1595C10E82DB1EE3A1258F0A7406F
    SPKI SHA256: A20E0B68402D5BEB16A8A85763B447C07D047DDDBD5C9AF21159546852FAE427
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D4242A01A5140C6C1FC7807646902
- SHA-256: 4D048713242889EFF7F69C21359C6A9F211DD52C19E9BF3EAF3FCF5C8D178ACB
- SPKI SHA-256: 7DD202D6C5792583CC711FA96D05DEFFA986DA2A342DD858B4030C0F0E0C46DA
- Validity: 2022-10-12 to 2024-10-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:42:a0:1a:51:40:c6:c1:fc:78:07:64:69:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:22 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D2:87:45:BC:33:8F:F5:14:2B:27:C0:F9:7E:CE:3D:EF:79:BA:2D:19
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4D048713242889EFF7F69C21359C6A9F211DD52C19E9BF3EAF3FCF5C8D178ACB
    SPKI SHA256: 7DD202D6C5792583CC711FA96D05DEFFA986DA2A342DD858B4030C0F0E0C46DA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF0515811AD64C6AB337A6FB92441BC
- SHA-256: 6564BF50F3520375B11F2A5BD432BB44E810ADC7EB2C4AD22F9CBE0C32B46162
- SPKI SHA-256: 2E23685F88F5E5F757B03F96A7E985EC0EBD30710EACCD16E147E14CD9AE19D7
- Validity: 2023-01-18 to 2025-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:58:11:ad:64:c6:ab:33:7a:6f:b9:24:41:bc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:45 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5B:F4:68:15:50:BB:B3:FB:0F:AC:5F:96:70:E5:A4:95:95:46:25:2B
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6564BF50F3520375B11F2A5BD432BB44E810ADC7EB2C4AD22F9CBE0C32B46162
    SPKI SHA256: 2E23685F88F5E5F757B03F96A7E985EC0EBD30710EACCD16E147E14CD9AE19D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C29EACD877DB02BDAEBD79087598
- SHA-256: CDACF412E2921C342B1943676433E60488E4BD39F193A9C22C12AA11B6796597
- SPKI SHA-256: CACB27108C1B3C4C1474E409EB13B81799CDDB9049FA93A4E9439D423FB88ED4
- Validity: 2023-04-19 to 2025-04-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:9e:ac:d8:77:db:02:bd:ae:bd:79:08:75:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:29 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F1:FF:66:E1:6E:96:21:2F:69:96:53:CB:46:A3:A5:9D:0C:97:C7:F9
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CDACF412E2921C342B1943676433E60488E4BD39F193A9C22C12AA11B6796597
    SPKI SHA256: CACB27108C1B3C4C1474E409EB13B81799CDDB9049FA93A4E9439D423FB88ED4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C46EE4542094D2E5A6E2F8D3838
- SHA-256: C905CAFDED19BAB5742F3A32F6C3CDEFA4E49564A348EA84BE2D033610816EC6
- SPKI SHA-256: 5980198741321B2051ED18568D12B899DD18FAFA7A5FDB274428A14054A9CB32
- Validity: 2023-07-19 to 2025-07-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:46:ee:45:42:09:4d:2e:5a:6e:2f:8d:38:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:27 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                71:3C:96:4F:E6:24:63:6C:2B:0A:64:2D:9F:29:DF:1B:FC:F8:EA:82
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C905CAFDED19BAB5742F3A32F6C3CDEFA4E49564A348EA84BE2D033610816EC6
    SPKI SHA256: 5980198741321B2051ED18568D12B899DD18FAFA7A5FDB274428A14054A9CB32
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0E7C932EA082351EEDF99AA5525
- SHA-256: 4BE6BA403D6ECFB5E73820F5CA1948253205DB186E396D779AC6B41BC8A826B4
- SPKI SHA-256: C1157CA73F93D3778E6215505EE91CF1A7585F52E1529B9A7CC474660A881536
- Validity: 2023-10-18 to 2025-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:e7:c9:32:ea:08:23:51:ee:df:99:aa:55:25
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:30 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:01:E2:4D:34:7A:72:AF:FD:68:E0:D0:1F:E4:AF:CF:A7:CF:CE:1D
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4BE6BA403D6ECFB5E73820F5CA1948253205DB186E396D779AC6B41BC8A826B4
    SPKI SHA256: C1157CA73F93D3778E6215505EE91CF1A7585F52E1529B9A7CC474660A881536
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E00363FA01EC2DBD5E8939B2ACA36
- SHA-256: 0E6C52F16FF4E5A7532EF39A7767299F0E284CC2C6B64713C1FBA882098C5DF5
- SPKI SHA-256: 9B03977B30B23A56149060CFB50D6A09AC1E787B162D437E4F05B6137082917D
- Validity: 2024-01-17 to 2026-01-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:36:3f:a0:1e:c2:db:d5:e8:93:9b:2a:ca:36
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:29 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:9B:48:67:3A:B9:51:E4:6B:9A:3E:D1:74:6D:99:F5:F9:6C:84:81
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0E6C52F16FF4E5A7532EF39A7767299F0E284CC2C6B64713C1FBA882098C5DF5
    SPKI SHA256: 9B03977B30B23A56149060CFB50D6A09AC1E787B162D437E4F05B6137082917D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56AC21AF5F81B3524E178857298FF
- SHA-256: 1BC54EE293B9992BF09F314C3D8C4477C2B0D2D6109A500EAB508F3565B633D6
- SPKI SHA-256: A7C541B4FF5C64320DC1B8EE8583F4A2D3673C5FF2488E4FE482AB21B32C97B2
- Validity: 2024-04-17 to 2026-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:c2:1a:f5:f8:1b:35:24:e1:78:85:72:98:ff
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:27 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:5C:98:C1:B1:40:5D:E8:99:54:F1:8F:03:0F:1F:CE:60:89:A5:BD
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1BC54EE293B9992BF09F314C3D8C4477C2B0D2D6109A500EAB508F3565B633D6
    SPKI SHA256: A7C541B4FF5C64320DC1B8EE8583F4A2D3673C5FF2488E4FE482AB21B32C97B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD50CE7866E6D40545196A551CA35
- SHA-256: 10B8949EC4FAF59886EA429ACD484B5BEC6F1D584CD36286178C98A99A294D80
- SPKI SHA-256: 7F0CE7E1FF44035538678531A694FE3B38677AC22C54072F908B293D8E4BB1E9
- Validity: 2024-07-17 to 2026-07-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:0c:e7:86:6e:6d:40:54:51:96:a5:51:ca:35
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:34 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4B:98:7E:25:87:8C:EE:BA:10:D7:0A:14:FF:0E:B3:DF:51:97:DF:C8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 10B8949EC4FAF59886EA429ACD484B5BEC6F1D584CD36286178C98A99A294D80
    SPKI SHA256: 7F0CE7E1FF44035538678531A694FE3B38677AC22C54072F908B293D8E4BB1E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV ACME CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 821441338B90E182AD9C39AB754E42FC
- SHA-256: 7F04D649A44A9ACB2491A9DB01B73C21E7275899311C4501FF3CD7349E09ECC5
- SPKI SHA-256: 6A771694DE520E86ED207AEAB31B541F63423C6455B333E4C959265881B912C5
- Validity: 2024-10-16 to 2026-10-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:33:8b:90:e1:82:ad:9c:39:ab:75:4e:42:fc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:07:58 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3A:96:BA:35:5E:82:26:FF:AB:0A:38:C9:3C:8F:1B:DB:5E:C5:C7:8F
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7F04D649A44A9ACB2491A9DB01B73C21E7275899311C4501FF3CD7349E09ECC5
    SPKI SHA256: 6A771694DE520E86ED207AEAB31B541F63423C6455B333E4C959265881B912C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV ACME CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV ACME CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B764FF3AE712BE7B79B199CB20BAA1
- SHA-256: CA2F2C4C625B8DF65ABD6F4694B822C81527209A42A5CD7BE48696CCE574C9D5
- SPKI SHA-256: 73BB38DCE971B08E29C8E6C700EFA80D0E8D552987A6F691607B5B5E16AD073E
- Validity: 2025-01-22 to 2027-01-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovacmeca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:64:ff:3a:e7:12:be:7b:79:b1:99:cb:20:ba:a1
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:22 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV ACME CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:0C:C5:C3:9E:B4:7C:51:81:8D:2E:5A:CB:65:5C:98:02:49:6E:D4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CA2F2C4C625B8DF65ABD6F4694B822C81527209A42A5CD7BE48696CCE574C9D5
    SPKI SHA256: 73BB38DCE971B08E29C8E6C700EFA80D0E8D552987A6F691607B5B5E16AD073E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV TLS CA 2020-12

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2020-12
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA8690A68E02D8CE4B9D572D9BBE
- SHA-256: 2EB8A1317288F08233E6883CEBE67EA6A0989E22ACA42C58D59F5A834E02C513
- SPKI SHA-256: A44D8C9FACC3072E59514C7F173DB9FD6AFF73661958E4FC1422697917E94D74
- Validity: 2020-12-09 to 2022-12-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca202012.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:86:90:a6:8e:02:d8:ce:4b:9d:57:2d:9b:be
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec  9 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2020-12
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                50:C3:25:D6:58:1C:C1:35:94:B3:43:7E:D5:B4:9D:CF:7D:C3:BA:9D
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2EB8A1317288F08233E6883CEBE67EA6A0989E22ACA42C58D59F5A834E02C513
    SPKI SHA256: A44D8C9FACC3072E59514C7F173DB9FD6AFF73661958E4FC1422697917E94D74
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB338F7C6C435B2706C77BC6DFCA4B
- SHA-256: F9D3214AD6F5D6D2B3C8161F96028B76812B058614A66786B92C8FEBDAC020EE
- SPKI SHA-256: 627AE35BD75E5C36963BC03A436FBC44DF2246FE5DB60A30290BFD922D90C76A
- Validity: 2021-10-20 to 2024-10-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:8f:7c:6c:43:5b:27:06:c7:7b:c6:df:ca:4b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E1:D8:B0:E3:2E:F9:E3:35:66:16:6A:6C:E2:35:54:4E:06:46:A9:07
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F9D3214AD6F5D6D2B3C8161F96028B76812B058614A66786B92C8FEBDAC020EE
    SPKI SHA256: 627AE35BD75E5C36963BC03A436FBC44DF2246FE5DB60A30290BFD922D90C76A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E42083FE86015ABC20DB5A437F89B
- SHA-256: A816AFFF746EA0F0A0A064C0432F9D2B7D0CE79EC2D1E9940F4A186A25182284
- SPKI SHA-256: 4DDA1C95A6361C428F003787D96FB8928B07CE6ED4BD801A7DC89D0819EC4430
- Validity: 2022-01-26 to 2025-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:08:3f:e8:60:15:ab:c2:0d:b5:a4:37:f8:9b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:B4:8E:DA:EA:08:40:B5:BF:86:23:05:5E:9E:C1:E6:5A:88:21:38
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A816AFFF746EA0F0A0A064C0432F9D2B7D0CE79EC2D1E9940F4A186A25182284
    SPKI SHA256: 4DDA1C95A6361C428F003787D96FB8928B07CE6ED4BD801A7DC89D0819EC4430
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C321A1D75F239623C710E904A3B
- SHA-256: E68C3376F010219CCA14E337F33183EF9D861E573A9D76287F3AAAD4D04FA38F
- SPKI SHA-256: A21990F56F85531B125C26022A389ADC0447CDC2651FC107D3A5CD5DDDA1956B
- Validity: 2022-04-20 to 2025-04-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:32:1a:1d:75:f2:39:62:3c:71:0e:90:4a:3b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:01:3D:80:B2:ED:C4:D8:1D:59:31:73:C7:8F:7E:F4:AC:2F:4A:BA
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E68C3376F010219CCA14E337F33183EF9D861E573A9D76287F3AAAD4D04FA38F
    SPKI SHA256: A21990F56F85531B125C26022A389ADC0447CDC2651FC107D3A5CD5DDDA1956B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174DD52CFEFF1535616C66E8B38BB
- SHA-256: D54CD0DADA36808945D1E4E414322E00AB09B9A800DA32D6C2B34B2CA12B9CEA
- SPKI SHA-256: 2D355AEB6A409C8BF611F185649559530B1482BC5B0B20863B9E79412F6FD8F6
- Validity: 2022-07-20 to 2024-07-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:dd:52:cf:ef:f1:53:56:16:c6:6e:8b:38:bb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:50 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BF:CF:C5:04:BB:D0:BA:86:7A:63:83:8F:ED:DD:45:06:F8:E8:21:83
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D54CD0DADA36808945D1E4E414322E00AB09B9A800DA32D6C2B34B2CA12B9CEA
    SPKI SHA256: 2D355AEB6A409C8BF611F185649559530B1482BC5B0B20863B9E79412F6FD8F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D425A8ECDF5393793EC94E2CDFA94
- SHA-256: BA2F574809F5FD3638F15A7E42DB3B465C8D66297B26451457F1633B7F762F35
- SPKI SHA-256: 5EB3E8DCD84D457207F80399CE0DDAE05FA641BB599CE2AF29EC0630381AF7B1
- Validity: 2022-10-12 to 2024-10-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:5a:8e:cd:f5:39:37:93:ec:94:e2:cd:fa:94
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:41 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:C2:AF:90:90:EF:78:15:AD:78:20:64:A8:7B:73:CC:53:8B:EA:21
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BA2F574809F5FD3638F15A7E42DB3B465C8D66297B26451457F1633B7F762F35
    SPKI SHA256: 5EB3E8DCD84D457207F80399CE0DDAE05FA641BB599CE2AF29EC0630381AF7B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF0517254865DDC09FC992FEF51FB7E
- SHA-256: 7CFB624140EFD55D44A324D10721CAF48DC64755DB6D11920F8D2B512F7EB70F
- SPKI SHA-256: B79C5F93F2CD0B7CAC7E67EB8CF190958CA58BAD48A04D8F74ADE7E2C65E6A75
- Validity: 2023-01-18 to 2025-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:72:54:86:5d:dc:09:fc:99:2f:ef:51:fb:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:37:06 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:EC:6B:FE:9A:5F:28:C8:3B:A3:57:56:33:06:FC:88:E5:89:FC:1B
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7CFB624140EFD55D44A324D10721CAF48DC64755DB6D11920F8D2B512F7EB70F
    SPKI SHA256: B79C5F93F2CD0B7CAC7E67EB8CF190958CA58BAD48A04D8F74ADE7E2C65E6A75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2AC96CEA195DB884AD6FD0FB595
- SHA-256: 405B1E8B6CBDDF1605C82D30AF52F02D8938873674ECA18A92ACBACE22610BDE
- SPKI SHA-256: 910543B08929A6A49A672D1814E8411FB02B5F3F910D111129ABF3C3FC1E24FE
- Validity: 2023-04-19 to 2025-04-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:ac:96:ce:a1:95:db:88:4a:d6:fd:0f:b5:95
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:40 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:8F:49:89:13:9F:96:B7:73:BB:DA:4C:3C:88:EF:72:C6:46:B2:A4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 405B1E8B6CBDDF1605C82D30AF52F02D8938873674ECA18A92ACBACE22610BDE
    SPKI SHA256: 910543B08929A6A49A672D1814E8411FB02B5F3F910D111129ABF3C3FC1E24FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C53ADB86DB243FB3D2A659B9B69
- SHA-256: FBBF50730E837A7436085C92483550FD65D85E0E4DFF121F77CF0F3B7C40BD4C
- SPKI SHA-256: 19914D48F20F29F34AAC78925EE590CD9EF9A967744801D92C9F21FA7FC59E51
- Validity: 2023-07-19 to 2025-07-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:53:ad:b8:6d:b2:43:fb:3d:2a:65:9b:9b:69
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:37 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A2:B9:06:4B:4C:5A:B5:74:81:0A:71:BF:EF:5D:A8:DD:83:30:EA:88
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FBBF50730E837A7436085C92483550FD65D85E0E4DFF121F77CF0F3B7C40BD4C
    SPKI SHA256: 19914D48F20F29F34AAC78925EE590CD9EF9A967744801D92C9F21FA7FC59E51
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0FBD7FD6D01642661BF4974C67B
- SHA-256: 514A14C828B3AB160DD9D11861BBEBE5EEFA2A6CA0AB86003CD1A080AA36A9D4
- SPKI SHA-256: 23C0732B31749E4451B39520668D341E77C667EEE05E836A6F3BE25D21906B56
- Validity: 2023-10-18 to 2025-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:fb:d7:fd:6d:01:64:26:61:bf:49:74:c6:7b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:46 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                31:3B:38:39:53:95:D1:49:64:27:6A:D9:64:C8:E4:69:1A:49:1D:3C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 514A14C828B3AB160DD9D11861BBEBE5EEFA2A6CA0AB86003CD1A080AA36A9D4
    SPKI SHA256: 23C0732B31749E4451B39520668D341E77C667EEE05E836A6F3BE25D21906B56
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E004543368B4AE7B60568DE9DC0D8
- SHA-256: 99E63B1A9E4C324664029C340275E308C61018CBC2E84CD8EA2366542EAA309C
- SPKI SHA-256: 4E5953A52C277DFBDF7EA1816C246AC01CBE6398730AB91BC9289F96E944FCF0
- Validity: 2024-01-17 to 2026-01-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:45:43:36:8b:4a:e7:b6:05:68:de:9d:c0:d8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:41 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CB:A9:33:2A:74:F1:B7:DA:C0:0C:C5:29:53:AB:97:03:41:34:33:30
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 99E63B1A9E4C324664029C340275E308C61018CBC2E84CD8EA2366542EAA309C
    SPKI SHA256: 4E5953A52C277DFBDF7EA1816C246AC01CBE6398730AB91BC9289F96E944FCF0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56ACE45CAA34AEF3F557001EEC235
- SHA-256: 53883007DD2CB3CE72C0F04FB35641AFA0AA131B1E01455E5C6B5901F1549328
- SPKI SHA-256: B7605A4EB493D7089747D7016304AC03D8B38BFD592317D2664E2B5F0B44A761
- Validity: 2024-04-17 to 2026-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:ce:45:ca:a3:4a:ef:3f:55:70:01:ee:c2:35
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:37 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                95:AE:DE:D6:68:40:40:DD:8B:67:55:C7:EB:75:E8:DC:BD:7D:FE:D6
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 53883007DD2CB3CE72C0F04FB35641AFA0AA131B1E01455E5C6B5901F1549328
    SPKI SHA256: B7605A4EB493D7089747D7016304AC03D8B38BFD592317D2664E2B5F0B44A761
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD528CEF1F3B27BAC20295ADD7A09
- SHA-256: 249D73A816C874C11E8B57F2775A5C8371B09C6C69F006A2321905DE5EBAC2FC
- SPKI SHA-256: E2C49AEC7593E765FBC2D52F5C9305EC3CFBC93BCFAE4C45FE3F34566962E3B2
- Validity: 2024-07-17 to 2026-07-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:28:ce:f1:f3:b2:7b:ac:20:29:5a:dd:7a:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:56 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:58:BE:3E:9A:DA:7C:70:D7:71:98:C9:2D:E4:C4:BA:9F:D9:4A:F5
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 249D73A816C874C11E8B57F2775A5C8371B09C6C69F006A2321905DE5EBAC2FC
    SPKI SHA256: E2C49AEC7593E765FBC2D52F5C9305EC3CFBC93BCFAE4C45FE3F34566962E3B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 OV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8214414BBCAF22AD8460919916588B4C
- SHA-256: E69C42BD4F99934B035730B1D3606132AB5C1D81FE7DD07D6D7DD05DC385DDD7
- SPKI SHA-256: EDC6BD54DEDA1484DA720DC8BF9185EB8A941C36B79B44D9BE68E5B3317BEB08
- Validity: 2024-10-16 to 2026-10-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:4b:bc:af:22:ad:84:60:91:99:16:58:8b:4c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:08:17 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                50:86:AF:1C:F8:29:5D:7A:37:6E:46:60:D4:D0:24:6D:34:78:51:AF
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E69C42BD4F99934B035730B1D3606132AB5C1D81FE7DD07D6D7DD05DC385DDD7
    SPKI SHA256: EDC6BD54DEDA1484DA720DC8BF9185EB8A941C36B79B44D9BE68E5B3317BEB08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B7651621D9A98BE6C9FF3845EC0F2A
- SHA-256: 018F50FAC1770E1D74E30F57107D12CA42A0F1748E39538FAE51C9A0D84EAA9C
- SPKI SHA-256: 9C09CC4D42BB60FE59665CFC12037530DD45A7848B5A77B3F912D47ECC23D0EE
- Validity: 2025-01-22 to 2027-01-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:16:21:d9:a9:8b:e6:c9:ff:38:45:ec:0f:2a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:40 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                02:58:D6:07:2B:D4:3D:E4:D1:D1:89:E0:18:6C:86:98:00:62:A9:5E
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 018F50FAC1770E1D74E30F57107D12CA42A0F1748E39538FAE51C9A0D84EAA9C
    SPKI SHA256: 9C09CC4D42BB60FE59665CFC12037530DD45A7848B5A77B3F912D47ECC23D0EE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C9B93B59423160E9E81E9791F3A
- SHA-256: 348E0923AF1DFA6A2F33A559FAEB8E139902A39042CE9AB8E5FA4E48A0EB85EB
- SPKI SHA-256: B2DC43ADC31CA1EDA566E2A1FE883B92CBC43523B82108A98159C51A88115F16
- Validity: 2025-04-16 to 2027-04-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:9b:93:b5:94:23:16:0e:9e:81:e9:79:1f:3a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:15:15 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:91:41:21:1B:DF:A4:E4:D0:61:76:B4:7A:16:FE:93:EA:25:83:B8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 348E0923AF1DFA6A2F33A559FAEB8E139902A39042CE9AB8E5FA4E48A0EB85EB
    SPKI SHA256: B2DC43ADC31CA1EDA566E2A1FE883B92CBC43523B82108A98159C51A88115F16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA86F59B6F9D9303C4CB71662A94F6
- SHA-256: 1FA2387E823CAD23020CC62785C8F94F15D248EF8CA23E42D43849A08F783A00
- SPKI SHA-256: 917DA28F99D40603D06336229815EAF530756D0486624611540DB68E501FB16A
- Validity: 2025-07-16 to 2027-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:f5:9b:6f:9d:93:03:c4:cb:71:66:2a:94:f6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:07:34 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                44:B5:94:07:4F:8C:08:4E:65:03:58:10:8B:D0:FF:A9:A9:21:3E:DA
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1FA2387E823CAD23020CC62785C8F94F15D248EF8CA23E42D43849A08F783A00
    SPKI SHA256: 917DA28F99D40603D06336229815EAF530756D0486624611540DB68E501FB16A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas ECCR5 OV TLS CA 2026 LT

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 LT
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8643E581BFE5DAB334DED1F455BD63DE
- SHA-256: 4165716A67236A64B18B265CAF241E198AFB00C9CD0E29CE618F46871820BB15
- SPKI SHA-256: 0C237FA3EB4CBDBDABA834EB216F58D367EAC1FC3E6248D260806EBD85F6102E
- Validity: 2026-07-22 to 2029-07-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:81:bf:e5:da:b3:34:de:d1:f4:55:bd:63:de
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 22 03:28:22 2026 GMT
            Not After : Jul 21 12:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2026 LT
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CE:BA:80:31:E9:C6:DD:AA:3A:E1:1B:1B:13:CB:5A:09:42:EA:31:D4
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4165716A67236A64B18B265CAF241E198AFB00C9CD0E29CE618F46871820BB15
    SPKI SHA256: 0C237FA3EB4CBDBDABA834EB216F58D367EAC1FC3E6248D260806EBD85F6102E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 OV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F45ED035A30913AEBCF9F28FE335
- SHA-256: 203C7A4B46C0264D1CCF40C1603A3982EA4E9ADA09D6EC82CB846393963F1A8B
- SPKI SHA-256: 0A4D10C061C635A063281F3E8647329E01C57418CC4BE036EA1177664C9DD8A0
- Validity: 2025-10-15 to 2027-10-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:5e:d0:35:a3:09:13:ae:bc:f9:f2:8f:e3:35
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:10:14 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                74:D1:0C:3F:FD:30:BA:67:5B:A4:14:71:BE:78:70:47:63:1A:8C:A7
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 203C7A4B46C0264D1CCF40C1603A3982EA4E9ADA09D6EC82CB846393963F1A8B
    SPKI SHA256: 0A4D10C061C635A063281F3E8647329E01C57418CC4BE036EA1177664C9DD8A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 OV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85150428C1437030996075E0F34B137E
- SHA-256: 820A9CA544A0EE39BE67FE6C97E17A0C4FF50F07FF545D41B9C72985C259D7BE
- SPKI SHA-256: 8087E49265188FA8A758CF73BC39156AC6C418697BC4A1DED56A29FD1B0DB880
- Validity: 2026-01-21 to 2028-01-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:28:c1:43:70:30:99:60:75:e0:f3:4b:13:7e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 03:01:00 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:64:A8:A2:D5:6B:C9:03:FB:2E:E8:F2:A0:BC:68:EB:33:00:EB:6A
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 820A9CA544A0EE39BE67FE6C97E17A0C4FF50F07FF545D41B9C72985C259D7BE
    SPKI SHA256: 8087E49265188FA8A758CF73BC39156AC6C418697BC4A1DED56A29FD1B0DB880
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 OV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC70CF6E25D53A85B1DF71D0E0034C
- SHA-256: F5C12D6A1783DAAC354BE9CAFD01FEC868E4621B6EF88789B668B736C748354D
- SPKI SHA-256: 5E29049EF02625103C0E504C1A11DEFA8D77CA8D95BAA0753A1D544A0C85B097
- Validity: 2026-04-22 to 2028-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:cf:6e:25:d5:3a:85:b1:df:71:d0:e0:03:4c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 03:01:05 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:94:A8:89:AA:5F:2D:57:59:0B:A1:7F:C7:79:8B:E1:F5:52:3E:F2
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F5C12D6A1783DAAC354BE9CAFD01FEC868E4621B6EF88789B668B736C748354D
    SPKI SHA256: 5E29049EF02625103C0E504C1A11DEFA8D77CA8D95BAA0753A1D544A0C85B097
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 OV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 OV TLS CA H2 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A298508EA976AD2A0EA5B4AC95AF0C0
- SHA-256: 90AF1B61A082662A639CAA68C6A3FB41EBBA3760C351A4A1E89FB6DACAD486FC
- SPKI SHA-256: 5992C6E3733FC630CB9D8D63685F6441C1BEEDBA500BC7CCD31B7D44AE27DDD6
- Validity: 2021-06-16 to 2024-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ovtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:08:ea:97:6a:d2:a0:ea:5b:4a:c9:5a:f0:c0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 OV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                63:BC:77:09:26:AA:84:E6:76:0F:29:2F:2E:04:20:7B:D9:22:C1:D5
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 90AF1B61A082662A639CAA68C6A3FB41EBBA3760C351A4A1E89FB6DACAD486FC
    SPKI SHA256: 5992C6E3733FC630CB9D8D63685F6441C1BEEDBA500BC7CCD31B7D44AE27DDD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas ECCR5 Qualified Timestamping CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas ECCR5 Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031894A5BAA03B29D82BAAA8B7430F
- SHA-256: E55A4FE881A4B0433674EC0E5CC261A99CCE3FEF649528C7218085BEDCD11512
- SPKI SHA-256: A850BA0DB3055B3BDAC473772E6B36914D72080D8162669E4E61F36F5B1BF41C
- Validity: 2020-07-28 to 2035-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5qualtimestampca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:94:a5:ba:a0:3b:29:d8:2b:aa:a8:b7:43:0f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2035 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas ECCR5 Qualified Timestamping CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                11:63:3A:C5:05:D8:3B:E8:FA:D3:17:48:CE:60:84:A3:DE:BE:69:21
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E55A4FE881A4B0433674EC0E5CC261A99CCE3FEF649528C7218085BEDCD11512
    SPKI SHA256: A850BA0DB3055B3BDAC473772E6B36914D72080D8162669E4E61F36F5B1BF41C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas ECCR5 UK Qualified Timestamping CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas ECCR5 UK Qualified Timestamping CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AA925309AB049316C080AEFDC6201
- SHA-256: 40382F8827B75D25705A6B3DA32533C5F4218BD7FA697CB0B300E8F47047FBC9
- SPKI SHA-256: 9043DF10F018E288E0091DF6ED5FB089C7E0B827B9B39996951ACFEFFB14B0EF
- Validity: 2020-09-16 to 2035-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlaseccr5ukqualtimestampca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:25:30:9a:b0:49:31:6c:08:0a:ef:dc:62:01
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2035 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign Atlas ECCR5 UK Qualified Timestamping CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DE:11:D9:FF:CF:64:63:FA:EA:A9:F2:1D:14:63:1F:45:A5:1C:4B:B8
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 40382F8827B75D25705A6B3DA32533C5F4218BD7FA697CB0B300E8F47047FBC9
    SPKI SHA256: 9043DF10F018E288E0091DF6ED5FB089C7E0B827B9B39996951ACFEFFB14B0EF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R1 EV TLS CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R1 EV TLS CA 2023
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7F87FB132910CBF823567AD268CD3330
- SHA-256: BFB08828EB69B99EE7CEBDD687C8E883A1FE07D3F998347F92EE9356414AD002
- SPKI SHA-256: A8DE11EB4EDEED414EB8586A58DDF4CDBBADC9C0E37CECA6EBA82510FC3CF204
- Validity: 2023-09-20 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr1evtlsca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:87:fb:13:29:10:cb:f8:23:56:7a:d2:68:cd:33:30
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep 20 03:21:19 2023 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R1 EV TLS CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BD:D9:0F:7C:F8:55:2C:8B:A9:8D:92:32:D9:12:25:DB:82:CA:74:CE
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BFB08828EB69B99EE7CEBDD687C8E883A1FE07D3F998347F92EE9356414AD002
    SPKI SHA256: A8DE11EB4EDEED414EB8586A58DDF4CDBBADC9C0E37CECA6EBA82510FC3CF204
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r1.crt
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 AlphaSSL CA 2022 Q1

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB33D87CA3A93347D967B8D75CBC25
- SHA-256: A04FA69E84CCD44F5E526B558631E346B21417D4D1B606A08CADE3928DBF1158
- SPKI SHA-256: 6C1D0DF05FDE4148095B03209BD4475F0D4ADEDFDC2E80B56359135F4FAA192C
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:d8:7c:a3:a9:33:47:d9:67:b8:d7:5c:bc:25
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B5:1A:82:94:26:93:AA:32:4C:08:F8:C2:65:B2:A8:DD:63:A9:1B:A7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A04FA69E84CCD44F5E526B558631E346B21417D4D1B606A08CADE3928DBF1158
    SPKI SHA256: 6C1D0DF05FDE4148095B03209BD4475F0D4ADEDFDC2E80B56359135F4FAA192C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2022 Q2

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E4244295E1DEAA6DAF288087E208F
- SHA-256: 45F1854530EC037AAACB4B2DE9B4D0FDBFC61888ABD4EE0414183D99E60437AC
- SPKI SHA-256: E9BA29E60B26551872D37DD7AAC23850A4DE93720C1C7A622D57A271D47F2EEC
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:44:29:5e:1d:ea:a6:da:f2:88:08:7e:20:8f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F9:CE:86:EF:92:A2:CF:DB:56:77:2A:1A:5C:98:D0:D5:DD:80:5E:64
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 45F1854530EC037AAACB4B2DE9B4D0FDBFC61888ABD4EE0414183D99E60437AC
    SPKI SHA256: E9BA29E60B26551872D37DD7AAC23850A4DE93720C1C7A622D57A271D47F2EEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2022 Q3

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C781DC1A87969D4B735145EE5F8
- SHA-256: 89578D72697AC25ABC6F6D382387443965412AC7448F103C9B1D11AB63A555CD
- SPKI SHA-256: BB63CF7D3A137F19671CC73C1D81E006B72D04C696F49A205FBEC786AFB39255
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:78:1d:c1:a8:79:69:d4:b7:35:14:5e:e5:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:8A:59:FA:6B:42:ED:E4:82:EB:84:5A:6F:4C:5B:6D:12:3D:94:AE
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 89578D72697AC25ABC6F6D382387443965412AC7448F103C9B1D11AB63A555CD
    SPKI SHA256: BB63CF7D3A137F19671CC73C1D81E006B72D04C696F49A205FBEC786AFB39255
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2022 Q4

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC17529B15FAFF481A112FCF93DD457
- SHA-256: 8146EAB73A6237D9F0668BA9C8BB4226E8257A54FAC41DB9626EA4F567ED4D1A
- SPKI SHA-256: 9C2B9DFF909720901EBD9898D4C39C2D078DF7589C8C93F921A14E49EB0F3892
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:75:29:b1:5f:af:f4:81:a1:12:fc:f9:3d:d4:57
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:26:51 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C1:34:61:38:61:E1:0E:40:76:29:F1:AF:ED:51:B4:00:6E:6C:5C:F6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8146EAB73A6237D9F0668BA9C8BB4226E8257A54FAC41DB9626EA4F567ED4D1A
    SPKI SHA256: 9C2B9DFF909720901EBD9898D4C39C2D078DF7589C8C93F921A14E49EB0F3892
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D429FEE9F59AF4A7AAB87FD9FAB6D
- SHA-256: D2DC5AADDC24B42C8E2CFDE756AF6B7A43CCAEFB75B9BD29AEE7C28CDE8CF1B4
- SPKI SHA-256: 6228D19C17FC410088AF6AE74986795FC96FB46BEC60A451F3DF6A9A7E19413C
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:9f:ee:9f:59:af:4a:7a:ab:87:fd:9f:ab:6d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:49:36 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A6:D5:C1:E4:3C:41:4C:BF:4C:8F:7B:D3:3E:32:94:71:9A:CB:B0:16
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D2DC5AADDC24B42C8E2CFDE756AF6B7A43CCAEFB75B9BD29AEE7C28CDE8CF1B4
    SPKI SHA256: 6228D19C17FC410088AF6AE74986795FC96FB46BEC60A451F3DF6A9A7E19413C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF051B507C3190676C3590A1A36B801
- SHA-256: 8FF94F390EF3D4B472C53399E25D8CA74636F68264F456FF5F111CD8CB9C0FD8
- SPKI SHA-256: C5240079D466766A0036B1099FB970E5FFE0A57F1CEAA309D3A8FEEEC2E14B34
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:b5:07:c3:19:06:76:c3:59:0a:1a:36:b8:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:37:59 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                80:D2:C3:33:1B:D3:22:BE:E5:04:FF:A7:39:28:95:7E:98:70:5D:8C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8FF94F390EF3D4B472C53399E25D8CA74636F68264F456FF5F111CD8CB9C0FD8
    SPKI SHA256: C5240079D466766A0036B1099FB970E5FFE0A57F1CEAA309D3A8FEEEC2E14B34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2FC793791953FF3D8BCBD6CC3C8
- SHA-256: F709C820518D6C38595CEF8355DBE02D24163B9F843652BA2C31230FC5806220
- SPKI SHA-256: 6FA0DE322ADE5A3A898ACF2EE2202ACC0F51FE6DD1817EB684BF136AC6D07183
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:fc:79:37:91:95:3f:f3:d8:bc:bd:6c:c3:c8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:53:43 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AE:DF:3B:BA:62:3A:04:D5:A6:0E:29:7C:68:6B:74:1F:17:9F:3C:AD
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F709C820518D6C38595CEF8355DBE02D24163B9F843652BA2C31230FC5806220
    SPKI SHA256: 6FA0DE322ADE5A3A898ACF2EE2202ACC0F51FE6DD1817EB684BF136AC6D07183
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C8D7C3CFCF7817984980DB0EC74
- SHA-256: AD4F4EFEDFE81378FD216E168EE1EB6972B9CEB796303E94BF76C5AF6350BDA3
- SPKI SHA-256: 51EE490E49B5BCA920A1ED28C287E2FB7DB7950E7B6690D9E9597955CA78830D
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:8d:7c:3c:fc:f7:81:79:84:98:0d:b0:ec:74
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:43:23 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                94:1E:B4:DC:83:BA:91:20:C9:FF:28:EC:7E:E9:16:B0:26:6F:DA:B6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD4F4EFEDFE81378FD216E168EE1EB6972B9CEB796303E94BF76C5AF6350BDA3
    SPKI SHA256: 51EE490E49B5BCA920A1ED28C287E2FB7DB7950E7B6690D9E9597955CA78830D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A13BF3DE255BE17DF80A845005B6
- SHA-256: 10B3103D2F490D2BF2E95ECCFAE7D6466E089923486196E49431C88FF361D7D7
- SPKI SHA-256: C63E54978F591C4E6DDB60D69D648A20731A7AEC0FABF8A426672E195524B8E4
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a1:3b:f3:de:25:5b:e1:7d:f8:0a:84:50:05:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:10:37 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:33:B1:E7:31:88:E9:FD:6A:F5:83:40:98:37:1A:E7:03:CC:F7:9B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10B3103D2F490D2BF2E95ECCFAE7D6466E089923486196E49431C88FF361D7D7
    SPKI SHA256: C63E54978F591C4E6DDB60D69D648A20731A7AEC0FABF8A426672E195524B8E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E007FA7C3085B5753CF657748538C
- SHA-256: CE11B00AD38D3092E618048865D28B5EE82D367D7296DD83389818C55C77DA3E
- SPKI SHA-256: F5CF76A6CF55888BEA5D7115DB444E379FE7BB248F93374E84AD87FA948500CA
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:7f:a7:c3:08:5b:57:53:cf:65:77:48:53:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:25:27 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CC:00:C2:5A:80:EE:06:77:FC:52:FD:26:2E:55:D0:06:02:E9:FF:01
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE11B00AD38D3092E618048865D28B5EE82D367D7296DD83389818C55C77DA3E
    SPKI SHA256: F5CF76A6CF55888BEA5D7115DB444E379FE7BB248F93374E84AD87FA948500CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56B08F7A1529441669A2D07C0C502
- SHA-256: A58405F641A0ABC11732C00D35A748F3BD0F52814337A6980D385DE3CDE04B3A
- SPKI SHA-256: 06EA0B1C66C8B383B96AC5884A1A583E8D0CEB784A283415A9FE38D39B80CEB1
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6b:08:f7:a1:52:94:41:66:9a:2d:07:c0:c5:02
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:18:23 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1F:74:21:5D:39:4B:37:51:09:EC:01:44:92:EF:53:5C:A7:44:90:77
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A58405F641A0ABC11732C00D35A748F3BD0F52814337A6980D385DE3CDE04B3A
    SPKI SHA256: 06EA0B1C66C8B383B96AC5884A1A583E8D0CEB784A283415A9FE38D39B80CEB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD561BE2A88E83AF12026FF179A2D
- SHA-256: E73A879C7784C73C7239E3BC8DD1F2FDC519DCEB11B16AB0A18B5A40E04E0C27
- SPKI SHA-256: 5E6148CBFE991A3B94BC1814EC4EFBD9ACDC03520C42D5FA51226B8CFE6306CA
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:61:be:2a:88:e8:3a:f1:20:26:ff:17:9a:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:10:41 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:0E:68:13:64:0B:8B:26:2E:E3:0E:CA:2B:1E:6D:D7:7D:AE:8D:10
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E73A879C7784C73C7239E3BC8DD1F2FDC519DCEB11B16AB0A18B5A40E04E0C27
    SPKI SHA256: 5E6148CBFE991A3B94BC1814EC4EFBD9ACDC03520C42D5FA51226B8CFE6306CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8214418D6588E47A6FA7F45CD1AA50D9
- SHA-256: B80E6635E3DA3142A9DE65DFF8C31DEADF0136BDB609AB526CB3D3B37ABCDC22
- SPKI SHA-256: 51F58733F63774E0F92EF1D14CB421C22A224D51DC4F4CD92B34F83E88514CD3
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:8d:65:88:e4:7a:6f:a7:f4:5c:d1:aa:50:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:09:09 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                15:66:14:6B:A9:C2:10:3A:ED:9E:ED:ED:4C:69:8E:4E:0A:64:BF:FD
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B80E6635E3DA3142A9DE65DFF8C31DEADF0136BDB609AB526CB3D3B37ABCDC22
    SPKI SHA256: 51F58733F63774E0F92EF1D14CB421C22A224D51DC4F4CD92B34F83E88514CD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 AlphaSSL CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B765558D12C707B4D9812A834D63BD
- SHA-256: 00390AE5DAEB1A08755906AA4E5C455FF7DBC6EB1677C23905B6A063D3BE6B65
- SPKI SHA-256: 02DAAC0B72EDE14C065AF6E37F64B84433533010D56EB26205DA67A5EB939AAF
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:55:8d:12:c7:07:b4:d9:81:2a:83:4d:63:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:07:30 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CC:FB:B2:ED:6F:A7:BB:9A:20:EA:25:86:D7:6D:A1:FF:71:B1:57:A1
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 00390AE5DAEB1A08755906AA4E5C455FF7DBC6EB1677C23905B6A063D3BE6B65
    SPKI SHA256: 02DAAC0B72EDE14C065AF6E37F64B84433533010D56EB26205DA67A5EB939AAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 AlphaSSL CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C1E6196FA44F30DE7A5021F9AA0
- SHA-256: DADEA3CF2CF2539C63672168FAE3C728023E0E5CB0E105DC52456FEB79424344
- SPKI SHA-256: 3933C1181032B41971921BFD3076E30F7F4CBB019BDF3C978BA6551237E7D0E1
- Validity: 2025-04-16 to 2027-04-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:1e:61:96:fa:44:f3:0d:e7:a5:02:1f:9a:a0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:13:36 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7A:F3:54:E9:AC:DB:FA:A7:59:2D:5D:D1:12:E1:79:03:54:B7:E4:C7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DADEA3CF2CF2539C63672168FAE3C728023E0E5CB0E105DC52456FEB79424344
    SPKI SHA256: 3933C1181032B41971921BFD3076E30F7F4CBB019BDF3C978BA6551237E7D0E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 AlphaSSL CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA869D6DF1F5EA173F24B151608692
- SHA-256: 3155F05DB3BA8A8E259733CEB15B852A956C1B40F2B94F21D99E82B9B5A60214
- SPKI SHA-256: 56AAE7740607A82F31AAAAB6AD9F5972258815ED164DC4F5265679D07533E3B3
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:9d:6d:f1:f5:ea:17:3f:24:b1:51:60:86:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:06:24 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                58:B7:41:D7:E7:74:70:C6:45:61:82:4C:F8:E0:F8:A6:70:B2:E2:D3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3155F05DB3BA8A8E259733CEB15B852A956C1B40F2B94F21D99E82B9B5A60214
    SPKI SHA256: 56AAE7740607A82F31AAAAB6AD9F5972258815ED164DC4F5265679D07533E3B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 AlphaSSL CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F3E51C92F3322222B987A108F86A
- SHA-256: 5771BD8366FC677C8E2BF3648E885538A14F358321DD492D6AD186501D138BE3
- SPKI SHA-256: 43A5D29DFE5FDEEF248952BC3D1BA26FD66202AB036D0EF80F4DD2A9E5F72EF4
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f3:e5:1c:92:f3:32:22:22:b9:87:a1:08:f8:6a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:08:37 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8D:F0:27:FD:C3:76:0F:14:B3:82:35:42:D0:D8:3D:69:4C:E1:94:A7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5771BD8366FC677C8E2BF3648E885538A14F358321DD492D6AD186501D138BE3
    SPKI SHA256: 43A5D29DFE5FDEEF248952BC3D1BA26FD66202AB036D0EF80F4DD2A9E5F72EF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 AlphaSSL CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 851503AF30A22A970F2B1C3B387EF98D
- SHA-256: BF8662E4FAB218C8249CBC7EA23588495EFBAB5D2857CBE1840734794546D280
- SPKI SHA-256: 921862E7589E04208830E2FBE340E45AE59024C95E19AA0BCACC26500665FEB7
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:af:30:a2:2a:97:0f:2b:1c:3b:38:7e:f9:8d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 02:59:24 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                89:AA:5D:F7:B9:34:6A:10:FD:EA:6C:07:D8:96:28:CD:2D:E9:02:E7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF8662E4FAB218C8249CBC7EA23588495EFBAB5D2857CBE1840734794546D280
    SPKI SHA256: 921862E7589E04208830E2FBE340E45AE59024C95E19AA0BCACC26500665FEB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 AlphaSSL CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC704B9EB8528DB9F1ECFDF9AA3867
- SHA-256: D057CB232F081DCB0C6A66A023E40600CF4CE7DF1E8CF612E5CB1280337C403B
- SPKI SHA-256: 8873A7125A9BFC4C865FBAD44FD4860D550CF731F93EAB84C900E7D5F52157F4
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:4b:9e:b8:52:8d:b9:f1:ec:fd:f9:aa:38:67
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 02:59:21 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EC:3B:11:93:6B:DC:8A:57:17:3C:5F:73:EF:D7:9B:8E:E2:BB:9B:6F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D057CB232F081DCB0C6A66A023E40600CF4CE7DF1E8CF612E5CB1280337C403B
    SPKI SHA256: 8873A7125A9BFC4C865FBAD44FD4860D550CF731F93EAB84C900E7D5F52157F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 AlphaSSL CA H1 2021

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA H1 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79299B2D0143BEFF23CEE6811E323802
- SHA-256: 1ABC5AD5BC3911A5B4A91E42BBA3212E2AA3DC80147EFE1D49572E4BE0532633
- SPKI SHA-256: 1C07623AB2063C6D785E4CA69E6790D7CE029B567C13DFA39CEA01BADDCF391C
- Validity: 2021-03-24 to 2024-03-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslcah12021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9b:2d:01:43:be:ff:23:ce:e6:81:1e:32:38:02
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 24 00:00:00 2021 GMT
            Not After : Mar 24 00:00:00 2024 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA H1 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B0:90:B2:C1:E8:E2:8B:FA:27:68:0E:A5:FB:F1:35:C0:EF:9F:CA:30
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1ABC5AD5BC3911A5B4A91E42BBA3212E2AA3DC80147EFE1D49572E4BE0532633
    SPKI SHA256: 1C07623AB2063C6D785E4CA69E6790D7CE029B567C13DFA39CEA01BADDCF391C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 AlphaSSL CA H2 2021

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign Atlas R3 AlphaSSL CA H2 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A29850F0A828529620C04EECEDB2DBF
- SHA-256: 11B6DB5B68DCDF34479AE7E7B7BBAA7165905577AD83D474F2BB9717CE244CEA
- SPKI SHA-256: C5E71A2EFF87141927EDB3EDD23F5ADF1EA84080319539343DA0BC08480000AF
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3alphasslcah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:0f:0a:82:85:29:62:0c:04:ee:ce:db:2d:bf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign Atlas R3 AlphaSSL CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E8:29:C6:D4:E5:0B:8E:F0:57:EC:2C:7E:7E:36:55:4F:9F:8E:E2:C6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11B6DB5B68DCDF34479AE7E7B7BBAA7165905577AD83D474F2BB9717CE244CEA
    SPKI SHA256: C5E71A2EFF87141927EDB3EDD23F5ADF1EA84080319539343DA0BC08480000AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB33649555892084337C88E247B74B
- SHA-256: 92651CD48A0288AA3075354DDC15DC24D0AF8EE67015B68A145970A093475E19
- SPKI SHA-256: 45334BFEBF241B8B453F858B0DB1F7B778CE46F2D8BDE47255EE4BA5E777CB69
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:64:95:55:89:20:84:33:7c:88:e2:47:b7:4b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:98:90:6B:6F:B9:51:08:02:8E:16:DC:8F:8B:B3:27:48:0F:7D:CA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 92651CD48A0288AA3075354DDC15DC24D0AF8EE67015B68A145970A093475E19
    SPKI SHA256: 45334BFEBF241B8B453F858B0DB1F7B778CE46F2D8BDE47255EE4BA5E777CB69
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41D5B075B666A0A98ED183E58DB7
- SHA-256: 2DFE47E144ABB39F9FE451CECD352D9A9BD28982351E8B6524FEB101DBAB1FEC
- SPKI SHA-256: FF55514BA1DAD2D445A3FF1AFFA3EAA85E30B63D7AA91C4E3B8AD74E3A833459
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:d5:b0:75:b6:66:a0:a9:8e:d1:83:e5:8d:b7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BE:4A:5C:94:C0:A8:C3:EE:7D:13:51:5A:25:54:30:0D:A4:A9:0F:D2
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2DFE47E144ABB39F9FE451CECD352D9A9BD28982351E8B6524FEB101DBAB1FEC
    SPKI SHA256: FF55514BA1DAD2D445A3FF1AFFA3EAA85E30B63D7AA91C4E3B8AD74E3A833459
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C008B77E87EA81C5E8ECB6BE4E1
- SHA-256: EB5E6C1AE30A0F9B8C5769105BA9D6882E4ACCBA5E2F2F72AC388A2FACA0FEF3
- SPKI SHA-256: 6F97B40A31FE40F4C26616BAED5809490DD48F596E9A29597E09B1730EA1CA2F
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:00:8b:77:e8:7e:a8:1c:5e:8e:cb:6b:e4:e1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AA:18:6A:07:D7:8A:FA:11:53:D3:A5:33:DC:7F:6D:4C:32:36:8C:B9
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EB5E6C1AE30A0F9B8C5769105BA9D6882E4ACCBA5E2F2F72AC388A2FACA0FEF3
    SPKI SHA256: 6F97B40A31FE40F4C26616BAED5809490DD48F596E9A29597E09B1730EA1CA2F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174AB9FE1E78CA06EF5CC2C3616C5
- SHA-256: 5CB88E6EFF315E275745B3C7288064A56142AB3EF9AC7067F1BB3D298FBAEF95
- SPKI SHA-256: 3010C85A6087B5A5CC42B7DFD86B73479E4E28CB251EF78CC4C3D3D406355CE1
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:ab:9f:e1:e7:8c:a0:6e:f5:cc:2c:36:16:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:11 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CE:C1:8A:C2:D5:9B:DF:5A:51:16:D5:06:38:B3:D8:92:AE:80:D4:9D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5CB88E6EFF315E275745B3C7288064A56142AB3EF9AC7067F1BB3D298FBAEF95
    SPKI SHA256: 3010C85A6087B5A5CC42B7DFD86B73479E4E28CB251EF78CC4C3D3D406355CE1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D41D75A48BA8069CCD56A44627316
- SHA-256: 71D7D6011C10185939C69087DFD44E5AC28DA5A20EA77E650BF983E4DFB99D1C
- SPKI SHA-256: BC31CB5DEF0366B56CACF744A7FBF0A50DCCE23603115E58065827BC2ABBE956
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:41:d7:5a:48:ba:80:69:cc:d5:6a:44:62:73:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:46:57 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BB:D2:1D:A6:52:68:B7:72:41:1A:9B:C7:AB:73:60:CE:0C:E8:A4:64
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 71D7D6011C10185939C69087DFD44E5AC28DA5A20EA77E650BF983E4DFB99D1C
    SPKI SHA256: BC31CB5DEF0366B56CACF744A7FBF0A50DCCE23603115E58065827BC2ABBE956
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF0513B1130590199B4CE9D9E0A3CDE
- SHA-256: 771CAE51FDB06185F011B768F6469918854E9EFC5992D626399F8AEF3FC10DB3
- SPKI SHA-256: D09ACF1A740EDF2B092C44B856EDE37E7004BED83894E21B398FE4B844296720
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:3b:11:30:59:01:99:b4:ce:9d:9e:0a:3c:de
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:22 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C0:A3:61:34:65:87:42:EC:0B:01:08:BB:C7:8B:5D:C0:33:67:9B:3A
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 771CAE51FDB06185F011B768F6469918854E9EFC5992D626399F8AEF3FC10DB3
    SPKI SHA256: D09ACF1A740EDF2B092C44B856EDE37E7004BED83894E21B398FE4B844296720
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C25FF1B7F2A3FF58E1E317C10E35
- SHA-256: 2FE4DAE370FCF2B58F0C75F2ABC49414B881F554ECF21485EAE73FEAA17B1DCD
- SPKI SHA-256: 55EDE5CAD8BCEEB1D9FA5DD5D4A50C448FF6687213294567DF54FA1FD9A9F6B1
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:5f:f1:b7:f2:a3:ff:58:e1:e3:17:c1:0e:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:51:39 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7B:A0:DF:87:B5:0C:0D:5B:AD:B1:61:FC:55:8B:BF:C3:7A:BA:57:5A
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2FE4DAE370FCF2B58F0C75F2ABC49414B881F554ECF21485EAE73FEAA17B1DCD
    SPKI SHA256: 55EDE5CAD8BCEEB1D9FA5DD5D4A50C448FF6687213294567DF54FA1FD9A9F6B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C31C598C7E413CBA38E46994DB9
- SHA-256: E0EE4B421D9059224F0CD3AD7BC9050B1DED78718A4AD26D8DE3FB40210F1FA1
- SPKI SHA-256: 381FAB263F5CC1E9EB4AD8163B173429FF27A1EE17D5B6BDA365D0AACA1AE639
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:31:c5:98:c7:e4:13:cb:a3:8e:46:99:4d:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:10 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                18:56:CD:2E:95:96:DE:FF:13:84:43:35:14:D4:69:C8:B9:3A:80:34
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E0EE4B421D9059224F0CD3AD7BC9050B1DED78718A4AD26D8DE3FB40210F1FA1
    SPKI SHA256: 381FAB263F5CC1E9EB4AD8163B173429FF27A1EE17D5B6BDA365D0AACA1AE639
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0D6083FC5415253D8EC6AE4F38B
- SHA-256: 57A44D4A69023D95BEB89A61A426579F453BC146F2A998987F3C7216E78A4B9D
- SPKI SHA-256: 490CBE4CB374D881117C6EDCF796F293D58FE48B762479A7DD4E537E74121591
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:d6:08:3f:c5:41:52:53:d8:ec:6a:e4:f3:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:16 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6D:B6:E4:8A:19:62:E9:4C:11:D6:3C:53:DB:66:C7:2D:3D:57:17:21
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 57A44D4A69023D95BEB89A61A426579F453BC146F2A998987F3C7216E78A4B9D
    SPKI SHA256: 490CBE4CB374D881117C6EDCF796F293D58FE48B762479A7DD4E537E74121591
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E0024C2B719325E6C22B7F766B9A1
- SHA-256: 53F2F2D3C2F952555407B8BB77012229C2A4E47F73CB45132DC95F6CEDD4396F
- SPKI SHA-256: 16A69E3C7E0D8868A28822F3D8324BCC92E6D644646A1E0C187B9AF30BD8A9D4
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:24:c2:b7:19:32:5e:6c:22:b7:f7:66:b9:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:15 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:21:3F:8C:0A:83:76:B6:3A:DA:10:A8:62:AE:C5:5F:6B:A2:67:59
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 53F2F2D3C2F952555407B8BB77012229C2A4E47F73CB45132DC95F6CEDD4396F
    SPKI SHA256: 16A69E3C7E0D8868A28822F3D8324BCC92E6D644646A1E0C187B9AF30BD8A9D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56AB1A27027E205AA46C3690768CE
- SHA-256: A404AC02E8F525544BB28EA0A18617F3A35B7A8852167222A154FC9336182ECB
- SPKI SHA-256: 9F4A24DFCCE3C6DE712A900E505374440C408FDBC53BCD68F5EF2B123D9B69BA
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:b1:a2:70:27:e2:05:aa:46:c3:69:07:68:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:14 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C6:F9:98:F1:F4:33:82:F0:43:CE:0B:D7:73:25:91:F4:A3:90:12:A9
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A404AC02E8F525544BB28EA0A18617F3A35B7A8852167222A154FC9336182ECB
    SPKI SHA256: 9F4A24DFCCE3C6DE712A900E505374440C408FDBC53BCD68F5EF2B123D9B69BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD4F502CBAF1EC2A1D53E1DC25406
- SHA-256: F6A33AFAF88990E858F1C7E0060CCB5B7F7E03F54ADD758CF8DBE25A9B042282
- SPKI SHA-256: 8E7DE7D4677590492FF58266393BF92ED465726E8B53CF709642F100321084F8
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d4:f5:02:cb:af:1e:c2:a1:d5:3e:1d:c2:54:06
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:15 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                57:EB:6F:38:FD:F5:5B:88:E6:9E:48:63:B2:B9:C2:4C:99:A4:DC:06
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6A33AFAF88990E858F1C7E0060CCB5B7F7E03F54ADD758CF8DBE25A9B042282
    SPKI SHA256: 8E7DE7D4677590492FF58266393BF92ED465726E8B53CF709642F100321084F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82144111CB41D3222030234F093B4EEE
- SHA-256: 0020D198028D12C73A2872376E24FBD73A39E39BF09338AC3B6495DD785DF678
- SPKI SHA-256: 479899BAC07407C235A64B107F5BA2F9B2A69B3B47800AB097CD047DACABA045
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:11:cb:41:d3:22:20:30:23:4f:09:3b:4e:ee
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:07:31 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8F:52:08:57:AE:53:F8:6C:28:07:E4:86:09:A6:99:F5:A6:B2:92:09
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0020D198028D12C73A2872376E24FBD73A39E39BF09338AC3B6495DD785DF678
    SPKI SHA256: 479899BAC07407C235A64B107F5BA2F9B2A69B3B47800AB097CD047DACABA045
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV ACME CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B764E731A67D1CED0A06EF2E10FDC8
- SHA-256: 4888596B61E698B180535EDDE9CC12FBEC87F4CDDD9074FB68A3FCF1C3F11150
- SPKI SHA-256: F17C396541D9D941C2B44E4EF556B62AEE6AEAC453CE0B91F7E46260FC622732
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmeca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:64:e7:31:a6:7d:1c:ed:0a:06:ef:2e:10:fd:c8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:03 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B9:C7:8F:44:6D:32:91:DD:E1:82:53:6C:73:B9:C7:2D:2A:56:72:46
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4888596B61E698B180535EDDE9CC12FBEC87F4CDDD9074FB68A3FCF1C3F11150
    SPKI SHA256: F17C396541D9D941C2B44E4EF556B62AEE6AEAC453CE0B91F7E46260FC622732
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV ACME CA H1 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA H1 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79299AB03637F16CA272E492592317D6
- SHA-256: 70F5C63C4F112837AB99870B0ECB5D722EEA0B0D0DDB9320B98B99B9BD137866
- SPKI SHA-256: 315482A964368A51BB5E81586E89E17D21755B4AFEFA577F5549B3E90A78536A
- Validity: 2021-02-24 to 2024-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmecah12021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9a:b0:36:37:f1:6c:a2:72:e4:92:59:23:17:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 24 00:00:00 2021 GMT
            Not After : Feb 24 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA H1 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B5:CE:5C:7B:F9:57:F7:C1:61:5F:9D:A1:DF:C0:07:02:E5:18:53:16
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 70F5C63C4F112837AB99870B0ECB5D722EEA0B0D0DDB9320B98B99B9BD137866
    SPKI SHA256: 315482A964368A51BB5E81586E89E17D21755B4AFEFA577F5549B3E90A78536A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV ACME CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV ACME CA H2 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A2985144EC21144E9CCE05B2CC5D7F4
- SHA-256: B254F3CDEAF1D29AB53CB439E80FB996F1E90A283E9B5085B8749D18E4F5987B
- SPKI SHA-256: 0EB8ABB79B22BFA6AE3B3D82B1D5F58A1D06ABF0368459304BCD9C612C8E3927
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvacmecah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:14:4e:c2:11:44:e9:cc:e0:5b:2c:c5:d7:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV ACME CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B7:21:D4:27:AB:6E:1D:56:EC:55:B8:D2:DE:7D:D4:60:99:F6:72:3B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B254F3CDEAF1D29AB53CB439E80FB996F1E90A283E9B5085B8749D18E4F5987B
    SPKI SHA256: 0EB8ABB79B22BFA6AE3B3D82B1D5F58A1D06ABF0368459304BCD9C612C8E3927
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031820CF0236F3A68518BAEFB7F701
- SHA-256: B65FE6A1BF2D52FF68B7D3E9D0F06B300A1C3F248309B70405CA7BDEC054BDDD
- SPKI SHA-256: C56EC1BA3A68E44FA5B2003020DE453F99DD825ED330925D2A18A9AE7A0E3FA9
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:20:cf:02:36:f3:a6:85:18:ba:ef:b7:f7:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                42:6D:57:2D:4F:1F:26:77:74:A6:27:64:F6:80:FA:8F:48:68:FE:7C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B65FE6A1BF2D52FF68B7D3E9D0F06B300A1C3F248309B70405CA7BDEC054BDDD
    SPKI SHA256: C56EC1BA3A68E44FA5B2003020DE453F99DD825ED330925D2A18A9AE7A0E3FA9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 DV TLS CA 2020-12

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2020-12
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA82A9CE034864AF4ED4A62924D7
- SHA-256: 59F5FF92B608A0119FF1DD7C603E0EB16F4FEAD9D4717AC3BC62D286AE399CDA
- SPKI SHA-256: A871225D488E7F3E8D8BD273FB3E514129EC2370EA4C853D930D17FD891F5EC5
- Validity: 2020-12-09 to 2022-12-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca202012.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:82:a9:ce:03:48:64:af:4e:d4:a6:29:24:d7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec  9 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2020-12
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:8D:BA:F3:5B:0B:C4:5E:D4:3A:CC:53:3D:3F:11:B7:74:4C:DE:DB
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 59F5FF92B608A0119FF1DD7C603E0EB16F4FEAD9D4717AC3BC62D286AE399CDA
    SPKI SHA256: A871225D488E7F3E8D8BD273FB3E514129EC2370EA4C853D930D17FD891F5EC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB337E594D23C76FDB7C4C629BDAD6
- SHA-256: D9E4A803FB498EEE9379FCF90AC3067AE65D098CC77890C37E575E249CD7D7C9
- SPKI SHA-256: CB9E43EE3DE5B821D8D56F2DDC03EB25C99D2E0E46CA68193E5ED7C3EBC8D6EF
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:7e:59:4d:23:c7:6f:db:7c:4c:62:9b:da:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9C:2A:67:D0:B4:83:31:5B:80:CB:29:96:55:75:09:37:38:B8:3C:A5
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D9E4A803FB498EEE9379FCF90AC3067AE65D098CC77890C37E575E249CD7D7C9
    SPKI SHA256: CB9E43EE3DE5B821D8D56F2DDC03EB25C99D2E0E46CA68193E5ED7C3EBC8D6EF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41F63DB18AAEAFED7B13604F1492
- SHA-256: 735CC386EC1A82E657A5B451C94959611D3C7D0CBB1FD9D9EDB42C7192F8463A
- SPKI SHA-256: ED981DFAD7350D1EB4114C71BBCEB2D8F36D9CF2D408338D510261377E475885
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:f6:3d:b1:8a:ae:af:ed:7b:13:60:4f:14:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                62:AA:74:A1:57:A0:ED:E2:C4:E4:48:98:14:E3:D3:DC:AE:79:51:25
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 735CC386EC1A82E657A5B451C94959611D3C7D0CBB1FD9D9EDB42C7192F8463A
    SPKI SHA256: ED981DFAD7350D1EB4114C71BBCEB2D8F36D9CF2D408338D510261377E475885
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C213FC6555345C91F191FB84EFA
- SHA-256: 12DCFF9B60269E3B546C3FFB7E74BA58EB7EEBCBF5956771F784F7A582C2EA7A
- SPKI SHA-256: D0EC9E5C2A0F6D8D7DA14DBCF35896EE2D5B02EF0D8BE1CC286374F2BFC6E572
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:21:3f:c6:55:53:45:c9:1f:19:1f:b8:4e:fa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:91:39:63:9A:FB:AD:10:24:E5:BE:B5:B9:DA:AB:D9:C4:46:69:AB
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 12DCFF9B60269E3B546C3FFB7E74BA58EB7EEBCBF5956771F784F7A582C2EA7A
    SPKI SHA256: D0EC9E5C2A0F6D8D7DA14DBCF35896EE2D5B02EF0D8BE1CC286374F2BFC6E572
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174CEFC9DBD7621E9A69FFF326BED
- SHA-256: 93AC271C0758A263A603567CDB6517D8FDEA13882154E0C41A75137C5613A222
- SPKI SHA-256: C8D1A3A81C068EEC4A9A0F94AD958917879BC91DD8AF130BF402C541CCC9117E
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:ce:fc:9d:bd:76:21:e9:a6:9f:ff:32:6b:ed
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:39 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:68:D9:1F:11:C4:0E:1F:9B:89:E0:A0:42:77:5F:C3:79:8E:C3:6E
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 93AC271C0758A263A603567CDB6517D8FDEA13882154E0C41A75137C5613A222
    SPKI SHA256: C8D1A3A81C068EEC4A9A0F94AD958917879BC91DD8AF130BF402C541CCC9117E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D424A0BD1ED1A3512A8E24955356C
- SHA-256: 7EC4FDED077CDD799A439637FC88AAC9546A7B1AE9F4DB0AD71ACCBC752E7E89
- SPKI SHA-256: C916E1E199EEF773305A9B5BE21F5B3E1B4B20FFB5C9D9452E2A7D48819C36FD
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:4a:0b:d1:ed:1a:35:12:a8:e2:49:55:35:6c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:28 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4A:EE:A2:47:63:43:3B:3E:78:F3:B4:61:83:72:88:7A:9D:E4:BD:B7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7EC4FDED077CDD799A439637FC88AAC9546A7B1AE9F4DB0AD71ACCBC752E7E89
    SPKI SHA256: C916E1E199EEF773305A9B5BE21F5B3E1B4B20FFB5C9D9452E2A7D48819C36FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF05160CA5D287B6776FA02E0D6BABC
- SHA-256: FA41F99D084E19438144D4FA7457C89ABA1BBA150BFB9DC4BF9D4D73E6623C6F
- SPKI SHA-256: 195DAA45A5B64C97FD84F22E237C27618BA93F106518269EE7A1C11FDA569CE7
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:60:ca:5d:28:7b:67:76:fa:02:e0:d6:ba:bc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:52 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C6:A2:61:13:45:15:CC:90:8F:BA:C1:AC:BC:CC:3B:0D:0E:D0:DE:06
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA41F99D084E19438144D4FA7457C89ABA1BBA150BFB9DC4BF9D4D73E6623C6F
    SPKI SHA256: 195DAA45A5B64C97FD84F22E237C27618BA93F106518269EE7A1C11FDA569CE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2A325B274BBFABC90D6C528655E
- SHA-256: CAAB391E482EE136BE74E3FAD9E3A1AC589EBE060B95508594876293EF87E7CE
- SPKI SHA-256: ABEFF091B029EDEAB0EB79FF8F99D7B9B4519A0D64925E2E276998DE7DC51DAD
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:a3:25:b2:74:bb:fa:bc:90:d6:c5:28:65:5e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:32 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                ED:A0:E6:01:05:3E:34:82:1A:A4:4F:5F:C5:BD:11:41:AA:DF:F3:61
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CAAB391E482EE136BE74E3FAD9E3A1AC589EBE060B95508594876293EF87E7CE
    SPKI SHA256: ABEFF091B029EDEAB0EB79FF8F99D7B9B4519A0D64925E2E276998DE7DC51DAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C49C60FC7562F5899D6CD6019B3
- SHA-256: BB32B9044163D739E82233AEBC7EF3A23565B748242EFE0973098748287D9E76
- SPKI SHA-256: EDDF0F3306F6F9688A1FEC8F829AE7A74942DBC9C0D7D5F34805A919E24EDB9E
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:49:c6:0f:c7:56:2f:58:99:d6:cd:60:19:b3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:29 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AA:11:71:8F:95:C4:58:98:8B:B1:6E:0F:3B:50:68:24:BC:B8:19:BC
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB32B9044163D739E82233AEBC7EF3A23565B748242EFE0973098748287D9E76
    SPKI SHA256: EDDF0F3306F6F9688A1FEC8F829AE7A74942DBC9C0D7D5F34805A919E24EDB9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0EA55E28C044C952E95D6349F5C
- SHA-256: 0152F86354FCA9525B280C233F7DA6CF8B5F2373C42644723226AE67238DB190
- SPKI SHA-256: B08CAEB09AD4920695F8DB94938D63FE53665F51D84733A6D1482570ED750E89
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:ea:55:e2:8c:04:4c:95:2e:95:d6:34:9f:5c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:32 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                66:C0:C7:A3:9A:CD:FE:F3:EA:CE:4B:53:0B:61:5E:AF:33:05:B3:E1
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0152F86354FCA9525B280C233F7DA6CF8B5F2373C42644723226AE67238DB190
    SPKI SHA256: B08CAEB09AD4920695F8DB94938D63FE53665F51D84733A6D1482570ED750E89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E003A272BC518E34DA4B1FC9B7833
- SHA-256: 1D2044E27BDC4411CA3FA340D082C1CC32B1366347D4063E898463AFAC3FFF06
- SPKI SHA-256: 43C127B0B93CBD32163739AC99301679AA2DF4AFDD1A92D96C9316FAA1084071
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:3a:27:2b:c5:18:e3:4d:a4:b1:fc:9b:78:33
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:32 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:0D:02:D0:C3:1B:9E:58:F8:EF:37:62:2D:E7:03:5D:9E:41:4A:8A
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1D2044E27BDC4411CA3FA340D082C1CC32B1366347D4063E898463AFAC3FFF06
    SPKI SHA256: 43C127B0B93CBD32163739AC99301679AA2DF4AFDD1A92D96C9316FAA1084071
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56AC5E23D4BAFC30E257C9702B7FF
- SHA-256: 5F0C6336D318BD0B46E1832514973360C9829301F4BA42A402A53A5A9421620E
- SPKI SHA-256: 253AE9B745E1020F55E06C26B0186FC2438550F070AADB40CD0BD0FE16C81E17
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:c5:e2:3d:4b:af:c3:0e:25:7c:97:02:b7:ff
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:30 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                65:E0:2A:53:1D:A7:47:F1:0D:31:80:3C:56:78:DB:EC:51:97:AC:33
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F0C6336D318BD0B46E1832514973360C9829301F4BA42A402A53A5A9421620E
    SPKI SHA256: 253AE9B745E1020F55E06C26B0186FC2438550F070AADB40CD0BD0FE16C81E17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD51426F2DDF6FF588022C88554F6
- SHA-256: B776DFF0079E90A6BF6897380D40D6CF0C80FE86E65A06E0DF02D581A87705E2
- SPKI SHA-256: 35E363291B0FE8CC051914BF2F755A43EDCCB9E4B12ED087E19A71B908D049D7
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:14:26:f2:dd:f6:ff:58:80:22:c8:85:54:f6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:40 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:91:EC:1C:02:F2:0E:FE:63:4F:65:CB:62:B0:02:2A:03:58:E9:B3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B776DFF0079E90A6BF6897380D40D6CF0C80FE86E65A06E0DF02D581A87705E2
    SPKI SHA256: 35E363291B0FE8CC051914BF2F755A43EDCCB9E4B12ED087E19A71B908D049D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 DV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8214413B0571A1A6810A8E520E0574F1
- SHA-256: 0BB2A52840F1DE1040118276872A63F0986E42B15D3A1D7779F1F7757C992ADC
- SPKI SHA-256: 41FDDA5D3A237FD9859C1131FD6A7905ED339EE50B0BB06F04A58DEB6EF5D35D
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:3b:05:71:a1:a6:81:0a:8e:52:0e:05:74:f1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:08:04 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:C4:28:11:E2:7D:9E:32:B1:21:4F:FB:7D:FF:E8:38:52:F1:92:E8
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0BB2A52840F1DE1040118276872A63F0986E42B15D3A1D7779F1F7757C992ADC
    SPKI SHA256: 41FDDA5D3A237FD9859C1131FD6A7905ED339EE50B0BB06F04A58DEB6EF5D35D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B76505D0CC8AFA728C12A842B7A8EA
- SHA-256: 45D045616EE8DB33AF7E508D471EC9EAA91239B49F0A0614D8E69EF0B716C168
- SPKI SHA-256: 27E6A8FEA887F41B1CB3361F2EF96D371DD5C7CFC553DC141A34F01643EC4A3C
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:05:d0:cc:8a:fa:72:8c:12:a8:42:b7:a8:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:27 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9C:FB:55:11:10:40:A2:3F:45:79:DD:5C:2E:82:63:93:40:16:47:CA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 45D045616EE8DB33AF7E508D471EC9EAA91239B49F0A0614D8E69EF0B716C168
    SPKI SHA256: 27E6A8FEA887F41B1CB3361F2EF96D371DD5C7CFC553DC141A34F01643EC4A3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C440DB4D0F7867AFE7C3A53CC2D
- SHA-256: 5539F8C9010518345FC21A85F25B39DD6AD8D591C7971CBB900C2CB7081BBF90
- SPKI SHA-256: 688F38DACA00737A95E0A623C15C59F9D89822849E793E86EEEF472770B84504
- Validity: 2025-04-16 to 2027-04-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:44:0d:b4:d0:f7:86:7a:fe:7c:3a:53:cc:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:14:06 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:BC:E7:57:82:E6:C0:63:96:B8:BD:4E:6B:00:B6:5F:A3:EF:FE:DF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5539F8C9010518345FC21A85F25B39DD6AD8D591C7971CBB900C2CB7081BBF90
    SPKI SHA256: 688F38DACA00737A95E0A623C15C59F9D89822849E793E86EEEF472770B84504
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA86AB0E31B19D8F03A5EDD5BDBD66
- SHA-256: F5165FC624453361E3A131C6AD90893A8DE40158921A94E8A4B445398EEDF6E0
- SPKI SHA-256: 6E221C831270EC73354DB749C62A0D52D5D42F80C018FDEFD5B2E25E5409C47C
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:ab:0e:31:b1:9d:8f:03:a5:ed:d5:bd:bd:66
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:06:35 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B0:43:9E:30:70:F6:DE:FD:54:1E:12:3A:1D:E0:F7:61:CB:FB:20:C7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F5165FC624453361E3A131C6AD90893A8DE40158921A94E8A4B445398EEDF6E0
    SPKI SHA256: 6E221C831270EC73354DB749C62A0D52D5D42F80C018FDEFD5B2E25E5409C47C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 DV TLS CA 2026 LT

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 LT
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8643E55AA18CE16BA067C8B69D8C0C59
- SHA-256: 34B10603A7012026D3B335D2DF33DC18124946E1151C5972B26DC4F687CA4494
- SPKI SHA-256: CC93AAD583862E41CC76846BD8708EF98920F0FC6060618641256B93300F608E
- Validity: 2026-07-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:5a:a1:8c:e1:6b:a0:67:c8:b6:9d:8c:0c:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 22 03:27:51 2026 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2026 LT
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D8:59:51:57:30:A6:2C:18:62:AC:1C:B7:F4:63:73:9E:38:14:50:86
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 34B10603A7012026D3B335D2DF33DC18124946E1151C5972B26DC4F687CA4494
    SPKI SHA256: CC93AAD583862E41CC76846BD8708EF98920F0FC6060618641256B93300F608E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 DV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F40B67F0DE163DD163A95FA7DAC3
- SHA-256: 1A6E1E3107328747396C74B70193D5C4EF72F75A1BE5706A5289929BFDB163F2
- SPKI SHA-256: DB829791E37339019108819CAD86C179410F87155A201D05109231BF62CB7483
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:0b:67:f0:de:16:3d:d1:63:a9:5f:a7:da:c3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:09:08 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:82:F1:5A:B5:8D:BB:E5:A4:E4:C7:0F:87:E6:CC:96:66:58:83:C9
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1A6E1E3107328747396C74B70193D5C4EF72F75A1BE5706A5289929BFDB163F2
    SPKI SHA256: DB829791E37339019108819CAD86C179410F87155A201D05109231BF62CB7483
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 DV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 851503D465640409D3C5907BE8765EF3
- SHA-256: 516AA665DBD48988E3F0CD9A670F89173E829ADFE38F607A0513C6683C2B9B95
- SPKI SHA-256: DB9E113194177ABC5681354B2D121A5E61FB3CC576FF7B5E411C28B22CCB4F58
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:d4:65:64:04:09:d3:c5:90:7b:e8:76:5e:f3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 02:59:53 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D4:66:0B:9F:02:70:4E:F7:44:08:27:FA:E9:F3:BD:C8:EB:57:71:70
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 516AA665DBD48988E3F0CD9A670F89173E829ADFE38F607A0513C6683C2B9B95
    SPKI SHA256: DB9E113194177ABC5681354B2D121A5E61FB3CC576FF7B5E411C28B22CCB4F58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 DV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC707BE570A2F1C5E8C70AB833E4C0
- SHA-256: 5D7B98CAFE69BDAF4DC6B57DA091F6A6F8F9B7C249A2BBA1318409EB347F4E6B
- SPKI SHA-256: 4084E6940289F1CC4AD8A35E524814328833455AD7CD33BB38EABFF0C124AEDD
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:7b:e5:70:a2:f1:c5:e8:c7:0a:b8:33:e4:c0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 02:59:59 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                59:34:32:61:8A:17:27:07:8C:EA:81:94:B3:81:FD:98:25:17:2F:34
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5D7B98CAFE69BDAF4DC6B57DA091F6A6F8F9B7C249A2BBA1318409EB347F4E6B
    SPKI SHA256: 4084E6940289F1CC4AD8A35E524814328833455AD7CD33BB38EABFF0C124AEDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 DV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 DV TLS CA H2 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A29851AB7F45D6679506641B6FFD71D
- SHA-256: 1DD095449FFB3CFF14B2224D596B83FD42F2B47683553C797D11150C918691BD
- SPKI SHA-256: 3FF07A9D4386E1C5252CD23CA3CD67D8C1126D49D83334F8F4595CE97E56D5B9
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3dvtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:1a:b7:f4:5d:66:79:50:66:41:b6:ff:d7:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 DV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2A:34:B9:AA:FA:BF:3C:88:F1:47:F2:D2:12:78:BE:C5:E5:AA:B0:69
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1DD095449FFB3CFF14B2224D596B83FD42F2B47683553C797D11150C918691BD
    SPKI SHA256: 3FF07A9D4386E1C5252CD23CA3CD67D8C1126D49D83334F8F4595CE97E56D5B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 EV QWAC CA 2022Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FEF017E01D679CD70A589E325F5B
- SHA-256: F2BC379B1EF45624D8F822B6E359502D470F384E53C082F7AE21869C13A5D345
- SPKI SHA-256: DBA376D121E74A0717BDF237560C86D3611E3A56AA410CE1B5E88D94DEA3AA6C
- Validity: 2021-05-19 to 2024-03-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3evqwacca2022q1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:f0:17:e0:1d:67:9c:d7:0a:58:9e:32:5f:5b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Mar 31 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 EV QWAC CA 2022Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                64:7B:50:52:59:38:F5:1D:C2:54:56:88:23:61:88:43:A0:2C:EF:07
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F2BC379B1EF45624D8F822B6E359502D470F384E53C082F7AE21869C13A5D345
    SPKI SHA256: DBA376D121E74A0717BDF237560C86D3611E3A56AA410CE1B5E88D94DEA3AA6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 EV QWAC CA 2022Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FEF3FA657349BB8F45405CC7B753
- SHA-256: 250AFA50B60D30D1217D00E7DD8CCE6B51F5C0B6A6369324842C37DEB44F9715
- SPKI SHA-256: 2C2E853FF9C29785687510F8E7FCE5BF0F1D5FF761D58CD626E35BA3C41D312D
- Validity: 2021-05-19 to 2024-06-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3evqwacca2022q2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:f3:fa:65:73:49:bb:8f:45:40:5c:c7:b7:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Jun 30 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 EV QWAC CA 2022Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B2:A3:C0:19:82:D0:69:25:45:B6:61:73:E6:33:8B:C1:A6:AC:81:5D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 250AFA50B60D30D1217D00E7DD8CCE6B51F5C0B6A6369324842C37DEB44F9715
    SPKI SHA256: 2C2E853FF9C29785687510F8E7FCE5BF0F1D5FF761D58CD626E35BA3C41D312D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 EV QWAC CA 2022Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FEF4D6777B5A307DF7098C2C7366
- SHA-256: 9D51DC2750A13BD627D99FDCC720D1904FE81059110BB9DE11B039A4B2ECA531
- SPKI SHA-256: 1EC6A24BBAD9CCC0EA6969F05BD633BBE14A353CE26CE281C34B205EC8F8E082
- Validity: 2021-05-19 to 2024-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3evqwacca2022q3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:f4:d6:77:7b:5a:30:7d:f7:09:8c:2c:73:66
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Sep 30 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 EV QWAC CA 2022Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:18:31:36:70:35:56:47:52:16:14:4E:CA:BD:25:FA:40:57:CB:54
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D51DC2750A13BD627D99FDCC720D1904FE81059110BB9DE11B039A4B2ECA531
    SPKI SHA256: 1EC6A24BBAD9CCC0EA6969F05BD633BBE14A353CE26CE281C34B205EC8F8E082
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 EV QWAC CA 2022Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 EV QWAC CA 2022Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FEF87578D79BB9EDDE499EA09EE1
- SHA-256: 451FA3A18064B4DD03ADFE8B8BBF16258CB98A1A6FEE5D6B0A37C98A0B5E6DAE
- SPKI SHA-256: 688B2A1AF48CB241D9D0BF2FD37E87F630089BE6DDF764C0E48FD0184D17F5DC
- Validity: 2021-05-19 to 2024-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3evqwacca2022q4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:f8:75:78:d7:9b:b9:ed:de:49:9e:a0:9e:e1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : Dec 31 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 EV QWAC CA 2022Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:C3:17:95:7B:34:86:53:CA:91:6F:7C:29:42:27:D3:07:27:47:AF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 451FA3A18064B4DD03ADFE8B8BBF16258CB98A1A6FEE5D6B0A37C98A0B5E6DAE
    SPKI SHA256: 688B2A1AF48CB241D9D0BF2FD37E87F630089BE6DDF764C0E48FD0184D17F5DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB336A9263FAD38BC7EB99058AE5EE
- SHA-256: EA532E6D78FF00FD4F56447F7E0A47D239D945424B77CF0D15A795CB4EE602BD
- SPKI SHA-256: 87FEED4D2CA71B50DDE919AA9DE43ECF1319B7342BB1B7FEEF4C890E66B5E0D7
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:6a:92:63:fa:d3:8b:c7:eb:99:05:8a:e5:ee
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                46:3D:19:F8:9E:E9:CC:D6:DA:F3:05:53:E1:9C:F1:9D:27:34:E2:AC
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EA532E6D78FF00FD4F56447F7E0A47D239D945424B77CF0D15A795CB4EE602BD
    SPKI SHA256: 87FEED4D2CA71B50DDE919AA9DE43ECF1319B7342BB1B7FEEF4C890E66B5E0D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41DE9CA15037E2F862442663EEB9
- SHA-256: D50B20ADFF959BFBEE83B6FD1FAB36FDE7941B960CFC6839AAC63B9FFDB46413
- SPKI SHA-256: 164DB977521A4DC0952CFF731B1D5513D1C57F9D058663A67225C87A607A9474
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:de:9c:a1:50:37:e2:f8:62:44:26:63:ee:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:80:F6:BD:04:20:A6:C6:4A:FF:DC:54:54:CD:30:3F:B9:AE:92:C2
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D50B20ADFF959BFBEE83B6FD1FAB36FDE7941B960CFC6839AAC63B9FFDB46413
    SPKI SHA256: 164DB977521A4DC0952CFF731B1D5513D1C57F9D058663A67225C87A607A9474
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C0B0835901ED6D47FA1DFF63593
- SHA-256: F06E2C3D05AF608C7BACB6366F7A47A017ADEC22F712BD417335396CB8B555BE
- SPKI SHA-256: BFEE9355B29B2B21973CB07D4CABEC6DA91E1217BEA62F9E693F6C1789A01ABD
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:0b:08:35:90:1e:d6:d4:7f:a1:df:f6:35:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2F:7C:EE:6A:E1:52:E6:F4:7B:8E:2C:EA:B3:EA:42:82:3E:59:92:94
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F06E2C3D05AF608C7BACB6366F7A47A017ADEC22F712BD417335396CB8B555BE
    SPKI SHA256: BFEE9355B29B2B21973CB07D4CABEC6DA91E1217BEA62F9E693F6C1789A01ABD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174C11BF2ACFABD605BBB0AEBF39D
- SHA-256: FA6331BA628DF599BEB2243BDE3A15098587704E956FE50A7933ABC0FCF79EF7
- SPKI SHA-256: 3536107741BDE7B4DAE51E6490EF167E6E6449CE492CD1E2718EA8BF7E659BCC
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:c1:1b:f2:ac:fa:bd:60:5b:bb:0a:eb:f3:9d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:28 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BD:11:4C:EE:0C:BB:CC:7E:4F:6C:69:4F:33:22:C5:76:B8:4D:71:C3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA6331BA628DF599BEB2243BDE3A15098587704E956FE50A7933ABC0FCF79EF7
    SPKI SHA256: 3536107741BDE7B4DAE51E6490EF167E6E6449CE492CD1E2718EA8BF7E659BCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D41E7F70DFFF2A7632FDA07F3A87D
- SHA-256: B22FF48B90A07C0AE65DD09AB80DD44AEF1912421DFFB7301583C24DCB637692
- SPKI SHA-256: 9E98B35E9C112185BF7F8B611C360AAB6C8747BFA01C423848F9FFE8C04F0C39
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:41:e7:f7:0d:ff:f2:a7:63:2f:da:07:f3:a8:7d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:47:10 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D2:F9:45:37:54:AE:DA:16:FD:67:D8:A5:D1:2F:0C:11:64:CA:E8:F3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B22FF48B90A07C0AE65DD09AB80DD44AEF1912421DFFB7301583C24DCB637692
    SPKI SHA256: 9E98B35E9C112185BF7F8B611C360AAB6C8747BFA01C423848F9FFE8C04F0C39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF0514DCE2D7D1F9695491F90C8CBD6
- SHA-256: 2127DBB280A2B296039D17E2E642EB9346C33990AB4298A664ADCA002FF67FFD
- SPKI SHA-256: 45C75A7267219DC8BF23C3FE947F100FC3B0733CCF986DC59DB16F2A7BDCCEF3
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:4d:ce:2d:7d:1f:96:95:49:1f:90:c8:cb:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:37 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B7:64:4A:4C:38:D6:88:82:94:BC:88:E5:56:2E:B3:04:7E:22:A1:63
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2127DBB280A2B296039D17E2E642EB9346C33990AB4298A664ADCA002FF67FFD
    SPKI SHA256: 45C75A7267219DC8BF23C3FE947F100FC3B0733CCF986DC59DB16F2A7BDCCEF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2976068AF33FEB6BF94C4235010
- SHA-256: 6557A37403091987483D6789ED9CE4549312674B91F57572397AA76806F009D5
- SPKI SHA-256: AF2B9E8424080D05CDB930A4D2658E0ED9E45E64316671B50F27C0366CF34A3A
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:97:60:68:af:33:fe:b6:bf:94:c4:23:50:10
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:23 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D9:25:35:71:69:FF:23:F8:09:D4:F9:DB:09:5F:96:CC:15:53:F6:AA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6557A37403091987483D6789ED9CE4549312674B91F57572397AA76806F009D5
    SPKI SHA256: AF2B9E8424080D05CDB930A4D2658E0ED9E45E64316671B50F27C0366CF34A3A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C3E8FA6D4283175741FDB082D14
- SHA-256: B8C5418C43F29D28CCEE6CC2795CEA84D0B22949B162597666F7893126C3CCF5
- SPKI SHA-256: 5B2D222232202F0A8E083869F4A84EB6B4F7EA644B02346D2212ABBB4DBEE7C6
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:3e:8f:a6:d4:28:31:75:74:1f:db:08:2d:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:20 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:56:DD:B8:C9:8F:52:78:43:0B:F0:C3:06:BD:B2:A6:6B:85:96:B0
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8C5418C43F29D28CCEE6CC2795CEA84D0B22949B162597666F7893126C3CCF5
    SPKI SHA256: 5B2D222232202F0A8E083869F4A84EB6B4F7EA644B02346D2212ABBB4DBEE7C6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0DEA76E097A747F87F96DE984D6
- SHA-256: C7AA7BDB14DD5EE2F9E6EC2367B64D500DE432E7BC51E9A8E4E9791B828CF65E
- SPKI SHA-256: DB78BD549204438B694C08454E04A4E9983AE29DA48D06A82218394F5DD2C895
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:de:a7:6e:09:7a:74:7f:87:f9:6d:e9:84:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:23 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:28:85:EB:5A:BC:4F:FE:C4:BB:1D:24:99:C9:B6:98:9B:E9:96:A0
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7AA7BDB14DD5EE2F9E6EC2367B64D500DE432E7BC51E9A8E4E9791B828CF65E
    SPKI SHA256: DB78BD549204438B694C08454E04A4E9983AE29DA48D06A82218394F5DD2C895
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E002DEAE06A0143705F753409644F
- SHA-256: AB437C6B0CF76DFE3ED7001743680A15169B8D88AEC00A9F71A6C2824AE8FF41
- SPKI SHA-256: B132138DDCB36EE7EA41C14C0B24C74BF17A03197321630BC8933C57C064FD3E
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:2d:ea:e0:6a:01:43:70:5f:75:34:09:64:4f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:22 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                30:AB:A2:73:74:E7:94:35:F7:63:C5:B5:7B:1E:B3:CE:66:BC:FE:AE
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB437C6B0CF76DFE3ED7001743680A15169B8D88AEC00A9F71A6C2824AE8FF41
    SPKI SHA256: B132138DDCB36EE7EA41C14C0B24C74BF17A03197321630BC8933C57C064FD3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56ABACA88633124BF3A7C1FCE19DC
- SHA-256: FEF8EDAA7BCBED69E1E2B7219527A8FC32BA76B1708E71492B3C491E3AF342E9
- SPKI SHA-256: 4521E4C917D76EF63B33C4E66CF293BBF9D653C150124ACBDDEEAB3F9D31CF08
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:ba:ca:88:63:31:24:bf:3a:7c:1f:ce:19:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:21 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                33:B8:B7:FE:64:68:BE:D6:63:24:F8:41:95:89:36:80:F7:24:FC:13
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FEF8EDAA7BCBED69E1E2B7219527A8FC32BA76B1708E71492B3C491E3AF342E9
    SPKI SHA256: 4521E4C917D76EF63B33C4E66CF293BBF9D653C150124ACBDDEEAB3F9D31CF08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD500695370780361060D5B788D52
- SHA-256: BFF85E127AEBF9786231EDC4985D381E1256B4EA759E71F515A570B3530AF655
- SPKI SHA-256: 1703720374DF9E7965AD1C65356BB31B08D25C7D4DB0EFEDDFFEC7CD253CAB4B
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:00:69:53:70:78:03:61:06:0d:5b:78:8d:52
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:24 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B6:6E:CA:F0:44:35:32:74:7F:8D:C4:93:26:BE:91:39:02:44:08:24
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BFF85E127AEBF9786231EDC4985D381E1256B4EA759E71F515A570B3530AF655
    SPKI SHA256: 1703720374DF9E7965AD1C65356BB31B08D25C7D4DB0EFEDDFFEC7CD253CAB4B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV ACME CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 821441231167DE496185B404C636573F
- SHA-256: 2D9B789B586812891683F70CE7008EDB76F5F0273F2BE60D57EB6B055EAAF6D6
- SPKI SHA-256: B49CEEB6D308F899E7FB79556283BC73FAE57D001F05C375D2E41CD9D28D77B0
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:23:11:67:de:49:61:85:b4:04:c6:36:57:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:07:45 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:E0:6B:9E:71:BD:54:A6:71:C1:F0:B4:78:35:42:24:90:C2:CE:8F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2D9B789B586812891683F70CE7008EDB76F5F0273F2BE60D57EB6B055EAAF6D6
    SPKI SHA256: B49CEEB6D308F899E7FB79556283BC73FAE57D001F05C375D2E41CD9D28D77B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV ACME CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV ACME CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B764F0039302C15B059CAF9B9A530A
- SHA-256: 7D9C0BAF36C0ACFA2D146DC2B35AC8F7EF37DCD0EA29EE00168C00377C640807
- SPKI SHA-256: 66274DBF379D83EBCA623282F99E1ACDBC9CBAC54ED72842CA028461EB75A2C5
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovacmeca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:64:f0:03:93:02:c1:5b:05:9c:af:9b:9a:53:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:10 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV ACME CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                02:97:A6:93:3B:AE:EC:35:00:1E:B3:D1:27:AA:D1:F0:AE:B5:B1:7F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7D9C0BAF36C0ACFA2D146DC2B35AC8F7EF37DCD0EA29EE00168C00377C640807
    SPKI SHA256: 66274DBF379D83EBCA623282F99E1ACDBC9CBAC54ED72842CA028461EB75A2C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV TLS CA 2020-12

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2020-12
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA845665FB025DA919336A1DF936
- SHA-256: A6032CC352F1E2E3628E162A3047BC7D647E2D601A2C0F26CAAF9AAF7A54239C
- SPKI SHA-256: ABC4736159EFF2EE16C52CCB784BCE7DF15FA6CAE681220788DB9625D2BB0655
- Validity: 2020-12-09 to 2022-12-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca202012.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:84:56:65:fb:02:5d:a9:19:33:6a:1d:f9:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec  9 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2020-12
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D1:41:E9:10:35:A6:97:A0:A0:1B:4C:88:1B:7A:B0:D8:75:46:0C:FA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A6032CC352F1E2E3628E162A3047BC7D647E2D601A2C0F26CAAF9AAF7A54239C
    SPKI SHA256: ABC4736159EFF2EE16C52CCB784BCE7DF15FA6CAE681220788DB9625D2BB0655
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB3383628B72188AE298A134D8DB34
- SHA-256: 536A35A3FA630379CF3B4D4B4E1395AF9CFED2243138E634E4369A31E2872843
- SPKI SHA-256: 14E221C6A1D6ADAA16AAE299ED5765F1966AFCB503951A397067E1FD47B6D8DE
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:83:62:8b:72:18:8a:e2:98:a1:34:d8:db:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                48:0C:A8:1C:47:E0:85:A9:C0:BA:05:DA:37:B2:F1:C7:20:73:19:14
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 536A35A3FA630379CF3B4D4B4E1395AF9CFED2243138E634E4369A31E2872843
    SPKI SHA256: 14E221C6A1D6ADAA16AAE299ED5765F1966AFCB503951A397067E1FD47B6D8DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E41FC02C22890D9B5D353F240FA85
- SHA-256: AFDB3C396D85D19FBE58206DF0659EAE614C4AB18F5CCF20B783AAF0BBE96A03
- SPKI SHA-256: 56435F213CE9F13DB17661CEC53D196547C7C92341CF153619615FAA60B7A0B1
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:41:fc:02:c2:28:90:d9:b5:d3:53:f2:40:fa:85
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:E5:9A:BB:6B:B0:7F:B7:DE:46:7C:95:A4:0C:1A:40:F0:71:EA:76
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AFDB3C396D85D19FBE58206DF0659EAE614C4AB18F5CCF20B783AAF0BBE96A03
    SPKI SHA256: 56435F213CE9F13DB17661CEC53D196547C7C92341CF153619615FAA60B7A0B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C277A0E74840481A0DA5757C444
- SHA-256: 29E93053769D4D1BAB841B8F5C2603BED5E0B82F339670869566892146E89141
- SPKI SHA-256: C27E8F5BA834D96B5ABA6904C73133370D5BA38333BB4FC85F7AD8DD2998F6DD
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:27:7a:0e:74:84:04:81:a0:da:57:57:c4:44
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A3:CC:BC:D2:3F:E9:F5:9A:AD:1F:14:62:82:2D:5F:67:93:94:23:B8
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 29E93053769D4D1BAB841B8F5C2603BED5E0B82F339670869566892146E89141
    SPKI SHA256: C27E8F5BA834D96B5ABA6904C73133370D5BA38333BB4FC85F7AD8DD2998F6DD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174D35EDB2C94CB3F16A14FEDE37B
- SHA-256: B7DD3E11DB6F04EF6BD1E98768C6805CCCCD1D37F8BD858B6D21645797147784
- SPKI SHA-256: 2EF2DD917AE5D495924590906E70F6549B3557D6FE02BF612F111C877844CBEC
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:d3:5e:db:2c:94:cb:3f:16:a1:4f:ed:e3:7b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:42 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C9:83:9C:06:DA:F0:B0:78:28:F0:4F:4B:8B:D1:18:2F:05:B7:D2:0E
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B7DD3E11DB6F04EF6BD1E98768C6805CCCCD1D37F8BD858B6D21645797147784
    SPKI SHA256: 2EF2DD917AE5D495924590906E70F6549B3557D6FE02BF612F111C877844CBEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D424ED5FB078C17F6534F4D2EE340
- SHA-256: D413C51E43C6880D9F39A295C496D8B50B1F6A446363A7C1AFACA9B510E5C300
- SPKI SHA-256: 53E9491504DCCF65F47B5E050084A544EB0F0B79AB28C69ABEA6F4915039351E
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:4e:d5:fb:07:8c:17:f6:53:4f:4d:2e:e3:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:32 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BE:60:97:8A:16:F4:3A:F9:7B:15:30:4B:88:76:F4:81:C5:40:02:00
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D413C51E43C6880D9F39A295C496D8B50B1F6A446363A7C1AFACA9B510E5C300
    SPKI SHA256: 53E9491504DCCF65F47B5E050084A544EB0F0B79AB28C69ABEA6F4915039351E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF05165A86E3BBFAED98ECA0B650B84
- SHA-256: EBA6880A6D960A2692A05AA539EF1C8EC03B3C455308DEE5A0F6A4DC050EDEA3
- SPKI SHA-256: 86CE0787E04D81FF4329C7515E445B6270D80E4238964561DEBD601EA60252A0
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:65:a8:6e:3b:bf:ae:d9:8e:ca:0b:65:0b:84
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:36:56 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0B:CF:7B:8E:98:A0:28:4B:3D:96:39:0D:FB:D0:34:BC:2F:F0:F5:76
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EBA6880A6D960A2692A05AA539EF1C8EC03B3C455308DEE5A0F6A4DC050EDEA3
    SPKI SHA256: 86CE0787E04D81FF4329C7515E445B6270D80E4238964561DEBD601EA60252A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2A66C6442598FE00BB1886E0371
- SHA-256: 4DE5FB201DAD1C9CCEA68648C2A9A03E53D5F39B5959D0608E707326F0C6432A
- SPKI SHA-256: 15F49C3E439B5439CB46B140DA9FEFE50360DF8809A07E00F8469C7ADF0091C9
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:a6:6c:64:42:59:8f:e0:0b:b1:88:6e:03:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:35 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:7D:3A:95:6E:67:B5:D9:11:31:53:20:6F:73:17:BA:1D:F8:33:A0
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DE5FB201DAD1C9CCEA68648C2A9A03E53D5F39B5959D0608E707326F0C6432A
    SPKI SHA256: 15F49C3E439B5439CB46B140DA9FEFE50360DF8809A07E00F8469C7ADF0091C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C4DC064CB2FEED9E477258E7071
- SHA-256: 67A9F71A282C4AD07586CA297B914926C2E1D331C5F64A46AFBD7D6378D89868
- SPKI SHA-256: F32EA66E117907CCF35789CC60221ED1097EBAEE5F4FBEFE02EE167FB5423A10
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:4d:c0:64:cb:2f:ee:d9:e4:77:25:8e:70:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:32 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:03:60:28:C2:8C:8E:EC:77:83:2D:61:24:51:9E:2B:C0:18:83:06
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 67A9F71A282C4AD07586CA297B914926C2E1D331C5F64A46AFBD7D6378D89868
    SPKI SHA256: F32EA66E117907CCF35789CC60221ED1097EBAEE5F4FBEFE02EE167FB5423A10
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0F41A0AD3F4C07A773ADF0DF15B
- SHA-256: 79AADFB93F2C467A37EDC83B5DD55A200EA9C32D3DFB6FAE2017A2C7E3306DCF
- SPKI SHA-256: C27C0154FFC3C30DAB82D61E8EBFCAA44D00CDEA8AC9D8A862292D87DF531755
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:f4:1a:0a:d3:f4:c0:7a:77:3a:df:0d:f1:5b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:40 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8D:A3:70:3A:74:53:A0:63:8B:70:10:3C:79:13:B1:6A:0C:2B:9C:07
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 79AADFB93F2C467A37EDC83B5DD55A200EA9C32D3DFB6FAE2017A2C7E3306DCF
    SPKI SHA256: C27C0154FFC3C30DAB82D61E8EBFCAA44D00CDEA8AC9D8A862292D87DF531755
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E003E0811B38296C883CC1AE2E9D8
- SHA-256: 4DE6175F3B0FCA3722159DBBC1A78D0C495F6EDAF233040AAFC2559888C176A5
- SPKI SHA-256: 5F91B9C052AFDDD55E6AB64A5B921C48251DE0FA1D814595DE9112707836EC2C
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:3e:08:11:b3:82:96:c8:83:cc:1a:e2:e9:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:35 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:B3:B6:41:EC:5A:18:86:C6:44:17:8F:3B:8A:9D:F2:49:17:79:C8
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4DE6175F3B0FCA3722159DBBC1A78D0C495F6EDAF233040AAFC2559888C176A5
    SPKI SHA256: 5F91B9C052AFDDD55E6AB64A5B921C48251DE0FA1D814595DE9112707836EC2C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56AC7EC78A7FF76A6724640E578D1
- SHA-256: C75B3A6333C7C4678DF3FDBAE0D3BB9ED825F9F13053E125ABE314A6E9C34443
- SPKI SHA-256: 91CF70CF1A3AF2B066B62ADA7316ECBAF8CE841D0F4779B49FF47CBC6BF4BC7E
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:c7:ec:78:a7:ff:76:a6:72:46:40:e5:78:d1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:32 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BE:35:A8:E3:69:61:39:46:74:BC:72:82:CB:C0:0E:43:2A:C8:99:7B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C75B3A6333C7C4678DF3FDBAE0D3BB9ED825F9F13053E125ABE314A6E9C34443
    SPKI SHA256: 91CF70CF1A3AF2B066B62ADA7316ECBAF8CE841D0F4779B49FF47CBC6BF4BC7E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD51C2CE3D147A3D9AA2CE9A10A6B
- SHA-256: BC54502E593530817801728103B6446E788B6F8C5811AE92491D13D054F9DF5D
- SPKI SHA-256: F0A02FB678BE24385B2FC480BD5979AB63817737B5C674BC9F6B314A176D3026
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:1c:2c:e3:d1:47:a3:d9:aa:2c:e9:a1:0a:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:09:46 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                78:C3:4D:86:D8:08:D4:C7:FC:6B:7B:6D:24:64:28:FA:5E:45:C9:05
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC54502E593530817801728103B6446E788B6F8C5811AE92491D13D054F9DF5D
    SPKI SHA256: F0A02FB678BE24385B2FC480BD5979AB63817737B5C674BC9F6B314A176D3026
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 OV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 821441401F7EDD1CEB9810C38FA09723
- SHA-256: 39821703A653DA1C851372CFD78A77DC095894865C036E9BA3E1164C7654D52C
- SPKI SHA-256: 17DD334B7A8BE136D7B4BCF2C14F8AF3A1D103F62E962241E6FE9E78A1F13E21
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:40:1f:7e:dd:1c:eb:98:10:c3:8f:a0:97:23
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:08:08 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F7:4E:F1:71:76:BB:61:5B:0B:74:53:76:31:03:EC:9C:9E:7A:48:F7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 39821703A653DA1C851372CFD78A77DC095894865C036E9BA3E1164C7654D52C
    SPKI SHA256: 17DD334B7A8BE136D7B4BCF2C14F8AF3A1D103F62E962241E6FE9E78A1F13E21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B7650A21E0FCCC88919003F155EA0C
- SHA-256: 0268A9930EFB3A8BB5CF614CDB3F1CD4605578A78F1BCA0C19680F8020F6A5DD
- SPKI SHA-256: 348DDBBABA0E31515F6E5DE1FCEB6EA8DB204BC6A2E2D5386641FF519FC0C3A4
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:0a:21:e0:fc:cc:88:91:90:03:f1:55:ea:0c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:31 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                48:51:26:CE:9D:AD:38:39:16:2E:52:C5:67:7A:91:34:00:13:DE:E3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0268A9930EFB3A8BB5CF614CDB3F1CD4605578A78F1BCA0C19680F8020F6A5DD
    SPKI SHA256: 348DDBBABA0E31515F6E5DE1FCEB6EA8DB204BC6A2E2D5386641FF519FC0C3A4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C8BFA4EF1C793077A99D187B214
- SHA-256: 6F9D6055094EFCFCD4E13B953E335334F04445AE4C11B97FF6BBE450D92BB3F3
- SPKI SHA-256: A29C1027DB145094DE4C5AA0567583A42F297368A8774C490C65DF17C4B83029
- Validity: 2025-04-16 to 2027-04-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:8b:fa:4e:f1:c7:93:07:7a:99:d1:87:b2:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:15:03 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5C:48:ED:A9:FB:FA:7A:CF:6E:A2:AD:95:2F:C6:6A:9D:1F:B3:18:16
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6F9D6055094EFCFCD4E13B953E335334F04445AE4C11B97FF6BBE450D92BB3F3
    SPKI SHA256: A29C1027DB145094DE4C5AA0567583A42F297368A8774C490C65DF17C4B83029
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA86E96ED0B5C7404746BEA1A2D1CC
- SHA-256: D1B2BAE3FF6E1307E8DFD281EEF5BAFC13AA7B6296C88D878CE42194BCBF3A6D
- SPKI SHA-256: 7C351A4D3CC4BBAFEE04D8BFDF71EF26103323D8A5AC490D3F9B9427E36CCD80
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:e9:6e:d0:b5:c7:40:47:46:be:a1:a2:d1:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:07:25 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2D:C0:86:6C:BA:34:46:1B:71:24:BB:61:80:7D:94:BB:A4:27:B8:45
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1B2BAE3FF6E1307E8DFD281EEF5BAFC13AA7B6296C88D878CE42194BCBF3A6D
    SPKI SHA256: 7C351A4D3CC4BBAFEE04D8BFDF71EF26103323D8A5AC490D3F9B9427E36CCD80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R3 OV TLS CA 2026 LT

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 LT
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8643E57D7802130C7B83DFCED17C61EA
- SHA-256: 2C1B536883E3EA5845C3886F0D534731CC5E9967AFE611F6170049FC41E52DC1
- SPKI SHA-256: 82738F206D592CF1053141A273886E6987B515397470DB147D20F03BF20357DD
- Validity: 2026-07-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:7d:78:02:13:0c:7b:83:df:ce:d1:7c:61:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 22 03:28:19 2026 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2026 LT
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5A:EA:EC:90:28:9B:3F:C0:E1:26:E4:24:05:65:AA:3C:24:62:7E:68
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2C1B536883E3EA5845C3886F0D534731CC5E9967AFE611F6170049FC41E52DC1
    SPKI SHA256: 82738F206D592CF1053141A273886E6987B515397470DB147D20F03BF20357DD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 OV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F44F9F937886B3FAA230714C5FC0
- SHA-256: 7233BB61704F3856AE8E2BBB0A86EED848C6136D78CD319CD6CB5EE4233E19BE
- SPKI SHA-256: B88283CF0AEBC0449CD1A9C1D633D662B9D40DC53F0FAF38202B5E72C457A309
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:4f:9f:93:78:86:b3:fa:a2:30:71:4c:5f:c0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:10:02 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:C4:B5:FE:8E:8D:6A:6A:6F:A3:EB:F1:BA:2C:5A:FC:DA:ED:55:6C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7233BB61704F3856AE8E2BBB0A86EED848C6136D78CD319CD6CB5EE4233E19BE
    SPKI SHA256: B88283CF0AEBC0449CD1A9C1D633D662B9D40DC53F0FAF38202B5E72C457A309
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 OV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8515041963A7F048F5B97CB7D13C2EC5
- SHA-256: 8BC47366C0E82A249EE1A8769813B7BFD6718D253DD69A6C4B4BE7693362F1E9
- SPKI SHA-256: 07C1481E9305BBA861300C276544EA06DF31C8866D4B13895ECB09109217B386
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:19:63:a7:f0:48:f5:b9:7c:b7:d1:3c:2e:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 03:00:48 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                91:1C:6D:0D:EB:54:F5:8E:55:6E:BD:16:50:24:4B:82:40:AE:31:EF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8BC47366C0E82A249EE1A8769813B7BFD6718D253DD69A6C4B4BE7693362F1E9
    SPKI SHA256: 07C1481E9305BBA861300C276544EA06DF31C8866D4B13895ECB09109217B386
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 OV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC70BC2355381938DC676CF937F558
- SHA-256: E52BAA3918E461B4336F76789B8ABA23972ABCF62461C6A32F3320A38433187A
- SPKI SHA-256: 26BE7517251A1EB079979756B33A78376BBE200B501C9324585AF906ABF14967
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:bc:23:55:38:19:38:dc:67:6c:f9:37:f5:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 03:00:50 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5C:5B:57:85:3B:4C:1A:83:D3:3E:FA:C5:4D:99:54:0C:C1:F2:7A:D7
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E52BAA3918E461B4336F76789B8ABA23972ABCF62461C6A32F3320A38433187A
    SPKI SHA256: 26BE7517251A1EB079979756B33A78376BBE200B501C9324585AF906ABF14967
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R3 OV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 OV TLS CA H2 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A2985224CB7D69CA97EB9ECD7C8D7E9
- SHA-256: 4E1A564C71A04288970E53C037D1CFC25C1F9BEFC5276CF3BD501EE262F04202
- SPKI SHA-256: 0F60F18EBFCAD96AD4A2E217B81325751EAE70149D0637D023A6E8254E91EA2F
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3ovtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:22:4c:b7:d6:9c:a9:7e:b9:ec:d7:c8:d7:e9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 OV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:91:16:22:87:8D:7C:D4:B0:B7:66:39:19:B9:8D:EE:1A:84:C3:22
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E1A564C71A04288970E53C037D1CFC25C1F9BEFC5276CF3BD501EE262F04202
    SPKI SHA256: 0F60F18EBFCAD96AD4A2E217B81325751EAE70149D0637D023A6E8254E91EA2F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R3 SMIME CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803186076FCD67814551D16C8C4F3AB
- SHA-256: 479D6A0980722966237F06C41842EE796B55D4D00A0D663B785D48433A29156E
- SPKI SHA-256: 41C3A0D79FC563CBD467AB2B03EE860A89E6F8F798C3E7D09AD4B91183B0863D
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:60:76:fc:d6:78:14:55:1d:16:c8:c4:f3:ab
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7C:CC:0A:68:D7:A2:EB:1E:2C:72:1B:D1:CD:5D:95:6F:8D:FB:F2:63
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 479D6A0980722966237F06C41842EE796B55D4D00A0D663B785D48433A29156E
    SPKI SHA256: 41C3A0D79FC563CBD467AB2B03EE860A89E6F8F798C3E7D09AD4B91183B0863D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 AATL CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 AATL CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 784AA8FE99682E3C3ABAFD2C11A6F458
- SHA-256: 65573E11BB13C6ED115E0B90E2C30B1E4DE4D5CAC1B31EAB2D417C32A3DA5D79
- SPKI SHA-256: 26EB28722E795772A3A375F16363F2EE0A657E553ADF19FF9D4C20F85C9729EA
- Validity: 2020-09-16 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45aatlca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a8:fe:99:68:2e:3c:3a:ba:fd:2c:11:a6:f4:58
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 AATL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EB:66:71:E5:9E:B9:A9:B4:79:2E:4C:12:33:BF:A5:E5:CF:13:49:92
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 65573E11BB13C6ED115E0B90E2C30B1E4DE4D5CAC1B31EAB2D417C32A3DA5D79
    SPKI SHA256: 26EB28722E795772A3A375F16363F2EE0A657E553ADF19FF9D4C20F85C9729EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 AATL CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 AATL CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 85151BEA1F1187977B9A52977DBF7107
- SHA-256: 2B0E0C426230950B6872A59DF80641A87918623E1394F8D6997BC38AA5DEC96C
- SPKI SHA-256: B0DC2BFC502258C25C2F9F242C4822E918FE7634BDCAE35B1778185935795148
- Validity: 2026-01-21 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45aatlca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:1b:ea:1f:11:87:97:7b:9a:52:97:7d:bf:71:07
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Jan 21 04:21:18 2026 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 AATL CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                95:0F:16:DD:15:29:30:5B:0C:41:05:3B:60:FC:95:04:3A:D3:53:5F
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2B0E0C426230950B6872A59DF80641A87918623E1394F8D6997BC38AA5DEC96C
    SPKI SHA256: B0DC2BFC502258C25C2F9F242C4822E918FE7634BDCAE35B1778185935795148
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 Client Authentication CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Client Authentication CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 83148A048B2513F5D24B86D9E18E42EA
- SHA-256: 612B045D9C08697594FD80E2BF6299150408F79FE1797D953FF208D5624A4D5F
- SPKI SHA-256: 22AC11548A474CB01851D658CC86801D185A27AFFD8A6E1236FE4C65DA5D9D2A
- Validity: 2025-03-19 to 2035-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45clientauthca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:8a:04:8b:25:13:f5:d2:4b:86:d9:e1:8e:42:ea
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Mar 19 03:32:07 2025 GMT
            Not After : Mar 19 00:00:00 2035 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Client Authentication CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                50:A3:69:7D:19:F1:23:2F:DE:59:D2:44:7F:30:CE:FC:8B:7F:36:E4
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 612B045D9C08697594FD80E2BF6299150408F79FE1797D953FF208D5624A4D5F
    SPKI SHA256: 22AC11548A474CB01851D658CC86801D185A27AFFD8A6E1236FE4C65DA5D9D2A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, IPSec User, ipsec Internet Key Exchange, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 Qualified Authentication CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Authentication CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 79B9FF02B981324354DF0438552E29DB
- SHA-256: 9BBAB193D19DBA9BA86497C633E89EB421131D29B64129B449832BEC2CC8259F
- SPKI SHA-256: 8EFFA8099B2D75A61CEEE0510E0A6F18EA8EDA37CF08CB3B0267A7B6D69DB1B7
- Validity: 2021-05-19 to 2027-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualauthca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:02:b9:81:32:43:54:df:04:38:55:2e:29:db
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Authentication CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                03:CE:8A:7F:69:2A:B7:1D:A2:07:2C:7A:68:46:9F:81:8B:1E:6F:6D
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 9BBAB193D19DBA9BA86497C633E89EB421131D29B64129B449832BEC2CC8259F
    SPKI SHA256: 8EFFA8099B2D75A61CEEE0510E0A6F18EA8EDA37CF08CB3B0267A7B6D69DB1B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R45 Qualified Non QSCD Signing CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Non QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 79B9FF06C4AE99CB05FB01FBD58380EB
- SHA-256: 96B67EB3D828223480405557E3993A3B1781D527294D1978EB0C4ABCC6F40AF2
- SPKI SHA-256: AD8589485971CF2E16EE573EBBA5A1D5FE3EF0F5CC1396D84C103BDAC9304A61
- Validity: 2021-05-19 to 2027-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualnonqscdsignca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:06:c4:ae:99:cb:05:fb:01:fb:d5:83:80:eb
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Non QSCD Signing CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:CF:BF:83:2C:38:91:1E:47:F4:D8:B1:45:D8:AB:DC:D1:C6:6D:45
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 96B67EB3D828223480405557E3993A3B1781D527294D1978EB0C4ABCC6F40AF2
    SPKI SHA256: AD8589485971CF2E16EE573EBBA5A1D5FE3EF0F5CC1396D84C103BDAC9304A61
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R45 Qualified QSCD Signing CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified QSCD Signing CA 2021, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 79B9FF6CB29EF5CFB9BA4522A583A04F
- SHA-256: 7A25E3C7B2B3325C5E65D01B9F6FF474ADE4BBCC8CCA3D7F29655352386F36B7
- SPKI SHA-256: 0795477E81908C155EC7E78403078D9A61921DE38882F75F50DDFD3C2CE0CFFF
- Validity: 2021-05-19 to 2027-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualqscdsignca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:6c:b2:9e:f5:cf:b9:ba:45:22:a5:83:a0:4f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 19 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified QSCD Signing CA 2021, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:BF:EB:3C:BC:69:38:74:EC:CE:A4:0E:C4:67:98:A4:F8:70:FC:FA
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7A25E3C7B2B3325C5E65D01B9F6FF474ADE4BBCC8CCA3D7F29655352386F36B7
    SPKI SHA256: 0795477E81908C155EC7E78403078D9A61921DE38882F75F50DDFD3C2CE0CFFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R45 Qualified Remote Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 7803188CB5863E37ABBF65279D507BB7
- SHA-256: 323F35F0DFB01D6B478C24026C66852AAD3E96DCB1C5BE17C1DA1EC47D77CC87
- SPKI SHA-256: 8EA5C653EF98CCACE069889C2E2046C0BDD8D369584D77E926B3F9EE5BD9F480
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualremotesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:8c:b5:86:3e:37:ab:bf:65:27:9d:50:7b:b7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Remote Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:C2:6F:B3:AF:2D:51:11:D5:8B:CA:A1:D5:F6:2B:2A:7E:E7:BE:DC
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 323F35F0DFB01D6B478C24026C66852AAD3E96DCB1C5BE17C1DA1EC47D77CC87
    SPKI SHA256: 8EA5C653EF98CCACE069889C2E2046C0BDD8D369584D77E926B3F9EE5BD9F480
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R45 Qualified Remote Signing CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Remote Signing CA 2024, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 808841185DE97206A9958DE2D7A7FD6C
- SHA-256: 5F4DE9476933306D850B530E01F543E70B461D48E402188F4E500679C304ED22
- SPKI SHA-256: D0E44E95FC8E3A723120CB17BD1088550646B7FA6A15AE8B51910ABFDC1A9488
- Validity: 2024-02-21 to 2030-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:88:41:18:5d:e9:72:06:a9:95:8d:e2:d7:a7:fd:6c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Feb 21 03:36:01 2024 GMT
            Not After : Feb 21 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Remote Signing CA 2024, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2A:23:30:22:F5:F6:0F:C7:DA:1E:1F:F2:25:59:16:5F:2C:8E:48:CA
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 5F4DE9476933306D850B530E01F543E70B461D48E402188F4E500679C304ED22
    SPKI SHA256: D0E44E95FC8E3A723120CB17BD1088550646B7FA6A15AE8B51910ABFDC1A9488
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 Qualified Timestamping CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 78031898B8DBBEA844937031867387F4
- SHA-256: D86E6264D58E4CA78AF419740D8186EA8EC48F0C33B4B4D7CA027931D627B1C8
- SPKI SHA-256: EBFDEEB8609E6E18F85827B6D5F6DB86E1D2D5AAF741D8EDAF80641175374027
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualtimestampca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:98:b8:db:be:a8:44:93:70:31:86:73:87:f4
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Timestamping CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                79:2F:93:47:3A:96:F5:B8:6E:1C:15:5E:7B:55:91:2A:FF:B8:03:D6
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: D86E6264D58E4CA78AF419740D8186EA8EC48F0C33B4B4D7CA027931D627B1C8
    SPKI SHA256: EBFDEEB8609E6E18F85827B6D5F6DB86E1D2D5AAF741D8EDAF80641175374027
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R45 Qualified Timestamping CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Qualified Timestamping CA 2024, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 80884139D84D342E5A93E4EA4390ADAE
- SHA-256: 984721239B82A5630CDECA98C0AD5B384FFB0E9DFF6767A0390510982AAA1AFB
- SPKI SHA-256: BB002D76A98C8E234343AC09E3D7B660F938B1893E9CB7528D4C9FCC0118C937
- Validity: 2024-02-21 to 2030-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45qualtimestampca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:88:41:39:d8:4d:34:2e:5a:93:e4:ea:43:90:ad:ae
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Feb 21 03:36:27 2024 GMT
            Not After : Feb 21 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Qualified Timestamping CA 2024, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                91:2F:FF:EA:1A:C4:F3:D2:78:57:EE:7E:01:E0:DC:41:73:DD:A7:68
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 984721239B82A5630CDECA98C0AD5B384FFB0E9DFF6767A0390510982AAA1AFB
    SPKI SHA256: BB002D76A98C8E234343AC09E3D7B660F938B1893E9CB7528D4C9FCC0118C937
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 Remote QSCD Delegated RA CA 2022

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 Remote QSCD Delegated RA CA 2022, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 7BFB74A13049597B0A6283C66DA61646
- SHA-256: AD304215A70BF5D06E84973BF49862F10CFF490DA9C97D1D6FA6934F8E3C98AF
- SPKI SHA-256: 24AC15E75B6B5B261F7076F7BBC7A96E69BFEA63AA9FD18C6A1E990A6171B682
- Validity: 2022-03-23 to 2028-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45remoteqscddelegatedraca2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:a1:30:49:59:7b:0a:62:83:c6:6d:a6:16:46
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Mar 23 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 Remote QSCD Delegated RA CA 2022, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                91:FC:5F:2A:48:58:8C:94:43:5E:DC:3B:D8:8A:E7:70:9B:D0:62:69
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: AD304215A70BF5D06E84973BF49862F10CFF490DA9C97D1D6FA6934F8E3C98AF
    SPKI SHA256: 24AC15E75B6B5B261F7076F7BBC7A96E69BFEA63AA9FD18C6A1E990A6171B682
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 SMIME CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8414C8693D082851545E68075F1F153E
- SHA-256: E08A15A2C88B55D910E2083443FBEB4781ECBA179B797EF4B7C5D0EA5694EA19
- SPKI SHA-256: 6AAB3773CA10ABA3AB853853F7B589F4CE9D4FE9951A87082B40000BCEABFC9D
- Validity: 2025-08-20 to 2032-08-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:14:c8:69:3d:08:28:51:54:5e:68:07:5f:1f:15:3e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Aug 20 03:21:02 2025 GMT
            Not After : Aug 20 00:00:00 2032 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:AC:FE:7D:57:18:D4:9B:51:50:80:CB:4E:83:FA:4D:34:28:D1:9F
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E08A15A2C88B55D910E2083443FBEB4781ECBA179B797EF4B7C5D0EA5694EA19
    SPKI SHA256: 6AAB3773CA10ABA3AB853853F7B589F4CE9D4FE9951A87082B40000BCEABFC9D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 TimeStamping CA 2022

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R45 TimeStamping CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 7DAA6CB73843C1D9FCA9A6BAD2871DBE
- SHA-256: 0C74179FDE6EFAD4A052C55DF083048430560483706179F305102E0C74B96CCB
- SPKI SHA-256: 299A81042EE903D1A88AA5AB69D311059F4D36F5C943B7E01143A3A0C7059DA5
- Validity: 2022-12-07 to 2039-12-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45timestampca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:aa:6c:b7:38:43:c1:d9:fc:a9:a6:ba:d2:87:1d:be
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Dec  7 03:32:29 2022 GMT
            Not After : Dec  7 00:00:00 2039 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R45 TimeStamping CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C1:1E:00:AD:4E:56:76:26:4C:97:F7:82:96:75:EE:34:BE:29:9F:B8
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.2
                Policy: 1.3.6.1.4.1.4146.1.30
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0C74179FDE6EFAD4A052C55DF083048430560483706179F305102E0C74B96CCB
    SPKI SHA256: 299A81042EE903D1A88AA5AB69D311059F4D36F5C943B7E01143A3A0C7059DA5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2, 1.3.6.1.4.1.4146.1.30
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R45 UK Qualified Remote Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas R45 UK Qualified Remote Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 784AA91C8E6A76CC3784A935FFD1F712
- SHA-256: 0958E7A84F392A4F3B7DC5E30FDC8DF733E69B44C68C16FC0DA1741C08419DA0
- SPKI SHA-256: 4EF0FF3EAADD50273D15364952CFCA4C2EA56ACC1E2F31B05DBA2899B43A79F2
- Validity: 2020-09-16 to 2026-09-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45ukqualremotesignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:1c:8e:6a:76:cc:37:84:a9:35:ff:d1:f7:12
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2026 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign Atlas R45 UK Qualified Remote Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                57:AF:35:2F:B5:DF:D3:29:97:CF:23:C8:D7:B3:41:1A:5C:24:60:54
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 0958E7A84F392A4F3B7DC5E30FDC8DF733E69B44C68C16FC0DA1741C08419DA0
    SPKI SHA256: 4EF0FF3EAADD50273D15364952CFCA4C2EA56ACC1E2F31B05DBA2899B43A79F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R45 UK Qualified Timestamping CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign Atlas R45 UK Qualified Timestamping CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 784AA9242552120B86CC7F5F66E87A77
- SHA-256: 4C03F2D6941F2DFCA27EDC599F385E6CD3FFD0CC842F2CCB95B77580A2D1FF93
- SPKI SHA-256: CDB69AFAC3B2D600CA779D0DE56C359D4C1552C15254A0B49D8616BDD6375DA9
- Validity: 2020-09-16 to 2026-09-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr45ukqualtimestampca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:24:25:52:12:0b:86:cc:7f:5f:66:e8:7a:77
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2026 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign Atlas R45 UK Qualified Timestamping CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BB:AE:8F:CE:9A:48:2B:48:28:3A:4F:58:B7:D5:FE:C3:96:99:F7:D2
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4C03F2D6941F2DFCA27EDC599F385E6CD3FFD0CC842F2CCB95B77580A2D1FF93
    SPKI SHA256: CDB69AFAC3B2D600CA779D0DE56C359D4C1552C15254A0B49D8616BDD6375DA9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 AlphaSSL CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83431C29BE5F91D66E9C58F9E86975CB
- SHA-256: 95E75CC493CE26BA23E8EBA2D43E770BC548EFE6C6E77BF4DF1D77D7C23D3F8A
- SPKI SHA-256: 3EE8A6BBAB3C4AAF6750D02BA0B768F07FC9CC9CD114589887D7439B28B4712A
- Validity: 2025-04-16 to 2027-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46alphasslca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:29:be:5f:91:d6:6e:9c:58:f9:e8:69:75:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 16 03:13:45 2025 GMT
            Not After : Jun 30 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 AlphaSSL CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                69:02:5A:20:1C:63:B3:F7:EE:09:20:64:72:D9:84:DC:DC:30:B6:0D
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 95E75CC493CE26BA23E8EBA2D43E770BC548EFE6C6E77BF4DF1D77D7C23D3F8A
    SPKI SHA256: 3EE8A6BBAB3C4AAF6750D02BA0B768F07FC9CC9CD114589887D7439B28B4712A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 AlphaSSL CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86A239809260DAF5EB068082E965
- SHA-256: FF567D21B6D92876A528B4EDCE0E85E0B9C89246ED263A131A2D63ECABF16554
- SPKI SHA-256: 7FD2E89A370A00BD2F64AA8250A8A9F814C609E4D70DABABC01CC643673E3932
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46alphasslca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:a2:39:80:92:60:da:f5:eb:06:80:82:e9:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:06:28 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 AlphaSSL CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F6:73:2F:BE:5B:7A:DC:AA:31:21:2E:81:15:51:33:E9:36:13:BA:0A
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FF567D21B6D92876A528B4EDCE0E85E0B9C89246ED263A131A2D63ECABF16554
    SPKI SHA256: 7FD2E89A370A00BD2F64AA8250A8A9F814C609E4D70DABABC01CC643673E3932
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 AlphaSSL CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8471F3F135131B24C0E87AFBC5A5F088
- SHA-256: AAA8AF92BB52B61D68246BBFB31FCA5BB1AE96093E0168122EB3EA32233CEBF1
- SPKI SHA-256: ECE02E310806D6713E6EE5FFE989E0C574920165D0CF10C84E39D8DC073164E0
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46alphasslca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f3:f1:35:13:1b:24:c0:e8:7a:fb:c5:a5:f0:88
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 15 03:08:47 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 AlphaSSL CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:EA:0C:C8:8B:B8:1A:A9:76:7E:9F:D5:CA:55:74:5F:DE:CA:86:96
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AAA8AF92BB52B61D68246BBFB31FCA5BB1AE96093E0168122EB3EA32233CEBF1
    SPKI SHA256: ECE02E310806D6713E6EE5FFE989E0C574920165D0CF10C84E39D8DC073164E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 AlphaSSL CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 851503B971DDD40D5959CF3EB5BD9229
- SHA-256: BCE36E8F5B181F9177DB5C8C6A9D65AB3A8B0471B0630124CD819DCE2CC5A810
- SPKI SHA-256: 71BD30DF2A2045DFE28287D501E2D54A435B289020799918D559CE3316B352CC
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46alphasslca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:b9:71:dd:d4:0d:59:59:cf:3e:b5:bd:92:29
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 21 02:59:32 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 AlphaSSL CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D7:45:83:ED:39:03:A8:0F:80:4E:D0:24:FB:8E:8B:17:8B:64:06:F7
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BCE36E8F5B181F9177DB5C8C6A9D65AB3A8B0471B0630124CD819DCE2CC5A810
    SPKI SHA256: 71BD30DF2A2045DFE28287D501E2D54A435B289020799918D559CE3316B352CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 AlphaSSL CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 AlphaSSL CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85AC70570AC1AFA28F512EBE1D75B021
- SHA-256: 33FC73C1C1CDAD21B9307D53BFBD2306FDA206357579D121868CB61AC4D7C86F
- SPKI SHA-256: F37D5AFAA0CB7D98C8BEDD5C87BA62ED760D15449B3799603FB281AEEBA12588
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46alphasslca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:57:0a:c1:af:a2:8f:51:2e:be:1d:75:b0:21
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 22 02:59:30 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 AlphaSSL CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:8F:5C:C1:B3:9C:8A:65:22:7E:F9:13:BA:0D:93:E3:8B:1D:BD:A6
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 33FC73C1C1CDAD21B9307D53BFBD2306FDA206357579D121868CB61AC4D7C86F
    SPKI SHA256: F37D5AFAA0CB7D98C8BEDD5C87BA62ED760D15449B3799603FB281AEEBA12588
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 DV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83431C491D6CFA9947CCB037AAE5A783
- SHA-256: 2FF834799072A8FF999B1F934D031BDD0E69980FAF3B4384152EEC2378FB753E
- SPKI SHA-256: BF37C8528927730F65FDD65CC18300507EE83D80CA2BABA453C0BF20519FAAA8
- Validity: 2025-04-16 to 2027-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46dvtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:49:1d:6c:fa:99:47:cc:b0:37:aa:e5:a7:83
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 16 03:14:10 2025 GMT
            Not After : Jun 30 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                22:CE:39:EA:78:22:F5:8E:CF:DD:78:0B:69:F4:F2:B7:CC:35:A0:29
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2FF834799072A8FF999B1F934D031BDD0E69980FAF3B4384152EEC2378FB753E
    SPKI SHA256: BF37C8528927730F65FDD65CC18300507EE83D80CA2BABA453C0BF20519FAAA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 DV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86AF9A4EF032EB8AF78A13FCF8FA
- SHA-256: 3093FABBB963D3F8729DDCA34972F73E560207A06D4A261C45456D3A8591E332
- SPKI SHA-256: 70651223EB7F4840E43ABB3A1894C3E8066D12642E4C7CAA7308C60375217DA4
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46dvtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:af:9a:4e:f0:32:eb:8a:f7:8a:13:fc:f8:fa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:06:39 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5B:1F:79:EF:D4:A0:67:03:5C:DD:64:B8:9B:FD:4D:6F:6E:79:12:0F
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3093FABBB963D3F8729DDCA34972F73E560207A06D4A261C45456D3A8591E332
    SPKI SHA256: 70651223EB7F4840E43ABB3A1894C3E8066D12642E4C7CAA7308C60375217DA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 DV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8471F411EAAA36C382AB9B0CCF36B701
- SHA-256: 2FE7CC388B51FDD62BD4130D4EEC62582B27550C504D18623D4CDAD9D67DF3D3
- SPKI SHA-256: 5FD7570AA6546796886827AD6BF0AAB97CFFC4A2369904012B350D84BDEA0809
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46dvtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:11:ea:aa:36:c3:82:ab:9b:0c:cf:36:b7:01
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 15 03:09:13 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E1:02:CF:DB:66:C6:65:49:32:D6:DD:31:2A:1E:26:11:F1:58:B5:29
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2FE7CC388B51FDD62BD4130D4EEC62582B27550C504D18623D4CDAD9D67DF3D3
    SPKI SHA256: 5FD7570AA6546796886827AD6BF0AAB97CFFC4A2369904012B350D84BDEA0809
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 DV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 851503DA7C197CC2C2C5ABC46B572B11
- SHA-256: C5A84EC914BBFA5A980ECAE7DE3D3E0958C094ABF20FC8DEEAABB1EABE6703D3
- SPKI SHA-256: F6AC3181109175DF9ECA0EDD5B363237496103D72B360C12F56FD7274279DB34
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46dvtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:da:7c:19:7c:c2:c2:c5:ab:c4:6b:57:2b:11
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 21 02:59:58 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                79:1F:43:E7:5E:87:CE:3E:D7:AC:D7:44:55:60:17:4A:EF:E5:08:45
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C5A84EC914BBFA5A980ECAE7DE3D3E0958C094ABF20FC8DEEAABB1EABE6703D3
    SPKI SHA256: F6AC3181109175DF9ECA0EDD5B363237496103D72B360C12F56FD7274279DB34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 DV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85AC708351E68DF704248BFDF17E4272
- SHA-256: 99AEC92EEA8FB536F74DFBFB8244E4C8F5AC3B658F7A988619797A4D04AC1036
- SPKI SHA-256: 7305985BB5B15C3C946902A96AF48D9E6A73D1B7B3BC116060ECB296A2696337
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46dvtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:83:51:e6:8d:f7:04:24:8b:fd:f1:7e:42:72
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 22 03:00:05 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DC:52:7D:D4:10:17:BE:E5:FB:01:44:B0:FB:19:CA:C7:EE:D0:28:EB
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 99AEC92EEA8FB536F74DFBFB8244E4C8F5AC3B658F7A988619797A4D04AC1036
    SPKI SHA256: 7305985BB5B15C3C946902A96AF48D9E6A73D1B7B3BC116060ECB296A2696337
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 DV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 DV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8643E5206C8ACB56BD7191D741A710E0
- SHA-256: AE6A9C50C942220C83920A316172ED64711E40AC5820F3861687C5C8A04D107E
- SPKI SHA-256: E4C07949BC4CC88321FE5D9DA024ECCA262E3F3F0520036967B130C79D7AAD5D
- Validity: 2026-07-22 to 2028-07-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:20:6c:8a:cb:56:bd:71:91:d7:41:a7:10:e0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 22 03:27:05 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 DV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CF:E5:C7:B9:54:C0:5C:7B:1E:A6:BB:DC:9F:62:57:34:D6:D6:AC:8B
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AE6A9C50C942220C83920A316172ED64711E40AC5820F3861687C5C8A04D107E
    SPKI SHA256: E4C07949BC4CC88321FE5D9DA024ECCA262E3F3F0520036967B130C79D7AAD5D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV QWAC CA 2023Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7BFB746AD3A1FD4C2DFFD1F9BC230405
- SHA-256: A7DCFD3D09377C39BA3A7F630E052EC593E9726D1DA57229E599D15AD6DCCA7B
- SPKI SHA-256: 73AC342D42116E42C3F1F6C30C72F8868FFB5E467CCDFF965AA00E95C1A9A343
- Validity: 2022-03-23 to 2025-03-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evqwacca2023q1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:6a:d3:a1:fd:4c:2d:ff:d1:f9:bc:23:04:05
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Mar 31 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV QWAC CA 2023Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1F:6C:70:A3:6F:57:C8:AA:51:31:3A:14:5A:81:DB:F0:0F:34:06:00
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A7DCFD3D09377C39BA3A7F630E052EC593E9726D1DA57229E599D15AD6DCCA7B
    SPKI SHA256: 73AC342D42116E42C3F1F6C30C72F8868FFB5E467CCDFF965AA00E95C1A9A343
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV QWAC CA 2023Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7BFB748565CC4329678D93D035A203C2
- SHA-256: A40C91E466D62CDB32B7139E8748F0EB5A817F6BB8A9F999A7A9BF4306D6D5D5
- SPKI SHA-256: DD9C921571476F93E5A3B74CFCD4B0F2728D525826DF056BA75AFDEF44E6CBD2
- Validity: 2022-03-23 to 2025-06-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evqwacca2023q2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:85:65:cc:43:29:67:8d:93:d0:35:a2:03:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Jun 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV QWAC CA 2023Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                34:7C:F5:6B:F5:8F:84:A7:3E:A6:88:C4:64:25:A7:3C:C5:7A:D2:79
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A40C91E466D62CDB32B7139E8748F0EB5A817F6BB8A9F999A7A9BF4306D6D5D5
    SPKI SHA256: DD9C921571476F93E5A3B74CFCD4B0F2728D525826DF056BA75AFDEF44E6CBD2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV QWAC CA 2023Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7BFB74902D43E327E4DA1D59310B6759
- SHA-256: 29C840D062AC862DB4D20928D2AEFD83B35A46BD4533995FF2EFD3E3EE8CFFD9
- SPKI SHA-256: 450F18025D878DE562E776065CA603A8EC40A9613C1B1025EB6E96270B807DF5
- Validity: 2022-03-23 to 2025-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evqwacca2023q3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:90:2d:43:e3:27:e4:da:1d:59:31:0b:67:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Sep 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV QWAC CA 2023Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:95:75:92:DF:12:EB:E4:6C:D2:09:5A:E5:AF:61:FE:E0:A2:AE:70
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 29C840D062AC862DB4D20928D2AEFD83B35A46BD4533995FF2EFD3E3EE8CFFD9
    SPKI SHA256: 450F18025D878DE562E776065CA603A8EC40A9613C1B1025EB6E96270B807DF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV QWAC CA 2023Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV QWAC CA 2023Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7BFB74978BE9F0416F4D9608671EAC08
- SHA-256: B51D85A08FACB06F97FDF58563749003033EE77DD583986204499197CA8E7077
- SPKI SHA-256: B59001B0C31CB43C4DD9D54237A7BC8C32126FE5C170CC61433B77F157DBB830
- Validity: 2022-03-23 to 2025-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evqwacca2023q4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:fb:74:97:8b:e9:f0:41:6f:4d:96:08:67:1e:ac:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 23 12:00:00 2022 GMT
            Not After : Dec 31 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV QWAC CA 2023Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A7:E3:BD:13:96:C5:9F:72:80:10:FB:F2:C5:4C:5F:7C:4C:30:8B:B9
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B51D85A08FACB06F97FDF58563749003033EE77DD583986204499197CA8E7077
    SPKI SHA256: B59001B0C31CB43C4DD9D54237A7BC8C32126FE5C170CC61433B77F157DBB830
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 780318385C02BD5BE1421594C405257C
- SHA-256: E1E15D289697AF3285BF34112A3E60BC11C0C8122DD2B9B3420AB2E5E57883CA
- SPKI SHA-256: 30CE4A61F0FF3FCC67B6342EFF02E0F250AE7CEDADE3D89606C26876DC310B51
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:38:5c:02:bd:5b:e1:42:15:94:c4:05:25:7c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                05:10:89:40:3A:92:91:A2:BC:4E:3E:7B:0A:AF:28:06:6B:7C:AC:63
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E1E15D289697AF3285BF34112A3E60BC11C0C8122DD2B9B3420AB2E5E57883CA
    SPKI SHA256: 30CE4A61F0FF3FCC67B6342EFF02E0F250AE7CEDADE3D89606C26876DC310B51
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7AFB33B52ADEEF8CE6948B98F5E9ACCC
- SHA-256: 4CFA14BC7E8F48D4677B0604777AF76AB0C55B326F8B97BA95F6ACE115C05F16
- SPKI SHA-256: EE8ED89D78C10B04A72364AA44FAC387ADAC7E0E7912B72067F6D7A2FA2A870D
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:b5:2a:de:ef:8c:e6:94:8b:98:f5:e9:ac:cc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                18:23:36:AE:51:65:2A:C5:34:43:8E:D5:3B:87:72:F2:F6:B3:BB:A6
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4CFA14BC7E8F48D4677B0604777AF76AB0C55B326F8B97BA95F6ACE115C05F16
    SPKI SHA256: EE8ED89D78C10B04A72364AA44FAC387ADAC7E0E7912B72067F6D7A2FA2A870D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7B9E42272B05C700B57FA480429B2437
- SHA-256: 398DC562DC098CF75F3A151216E583380C279444B0D63E766D9FDF6F47D04C60
- SPKI SHA-256: B19B6501282DC2DF2D99229DA8C80D04B52F2EE6A2FA791F580DF113713266F9
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:27:2b:05:c7:00:b5:7f:a4:80:42:9b:24:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2B:96:95:2B:29:99:B0:56:ED:76:0D:90:B5:03:A0:2F:74:81:74:A8
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 398DC562DC098CF75F3A151216E583380C279444B0D63E766D9FDF6F47D04C60
    SPKI SHA256: B19B6501282DC2DF2D99229DA8C80D04B52F2EE6A2FA791F580DF113713266F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7C2A0C56B795E2AFEB8DFFFB596AB778
- SHA-256: 0ED5AA0061D09B703E1B3150FB6367870BBF245CCEED4FE08F2DBE4201723A8D
- SPKI SHA-256: 659FC17EA1456E13BB4920A6BBBF2FF0DD82139CA42BDFB3CF7EEC5842161172
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:56:b7:95:e2:af:eb:8d:ff:fb:59:6a:b7:78
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7A:CB:93:DC:57:42:2F:F0:5C:2B:A8:63:BA:57:23:33:E7:7A:91:E2
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0ED5AA0061D09B703E1B3150FB6367870BBF245CCEED4FE08F2DBE4201723A8D
    SPKI SHA256: 659FC17EA1456E13BB4920A6BBBF2FF0DD82139CA42BDFB3CF7EEC5842161172
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2022 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7CC174FF6986F29B814D2568A78EFD90
- SHA-256: B050000CF749EC658A6B9ED8D4C3A393435644A327603FB036327E32A47BFBA4
- SPKI SHA-256: 29DED14C8EAC2B00539C53F4D92D3E15463113E72F1DCAD9968A4DC9C3F57F09
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:ff:69:86:f2:9b:81:4d:25:68:a7:8e:fd:90
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 20 03:26:17 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                82:35:82:19:1D:44:BF:79:97:52:D1:E1:D0:68:C8:8E:75:25:C7:30
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B050000CF749EC658A6B9ED8D4C3A393435644A327603FB036327E32A47BFBA4
    SPKI SHA256: 29DED14C8EAC2B00539C53F4D92D3E15463113E72F1DCAD9968A4DC9C3F57F09
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7D4D427D7B3F5118D7F671FBE66340E9
- SHA-256: A02C04DAB0B317A4910753F2F74E3C78B39AD210E5CB72870B278122AD35B265
- SPKI SHA-256: 94293B53407B1B1986F86DF31BD34C661056E735FD586D8E38C41D704A1A20CD
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:7d:7b:3f:51:18:d7:f6:71:fb:e6:63:40:e9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 12 03:49:09 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:28:74:72:4A:5B:E8:BA:42:CA:00:9E:72:D5:45:9D:A1:63:3D:A5
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A02C04DAB0B317A4910753F2F74E3C78B39AD210E5CB72870B278122AD35B265
    SPKI SHA256: 94293B53407B1B1986F86DF31BD34C661056E735FD586D8E38C41D704A1A20CD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7DF051942628BA3D5F4E485052EC0EFA
- SHA-256: BA0DF2D121A739E0002AA19B5B2400F4204A324F28669356CEB0B1B2DADF8B86
- SPKI SHA-256: C8CFF06D82EFD4BA3E8443946B5D7BA7311DAA69B18F6BCB8859CE58AAFD2486
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:94:26:28:ba:3d:5f:4e:48:50:52:ec:0e:fa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 18 03:37:33 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:46:6D:5E:2C:0B:06:22:E9:FE:BB:7B:4C:82:32:0A:68:C2:DE:79
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BA0DF2D121A739E0002AA19B5B2400F4204A324F28669356CEB0B1B2DADF8B86
    SPKI SHA256: C8CFF06D82EFD4BA3E8443946B5D7BA7311DAA69B18F6BCB8859CE58AAFD2486
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7E87C2DFC25DECCFA4F85AD565340A2F
- SHA-256: 2335D5EDFA507EB56B7DAC00F434D55B9565A6F968E4CD3AC01BAC2317A10B16
- SPKI SHA-256: CB12DC1499E4457191F8A54B09997E08790F6D1179CBE44237D31D11BB4838D9
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:df:c2:5d:ec:cf:a4:f8:5a:d5:65:34:0a:2f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 19 03:53:20 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:C9:CA:26:EE:0B:44:E2:8C:09:9C:5B:33:7B:68:13:A6:D0:FA:B4
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2335D5EDFA507EB56B7DAC00F434D55B9565A6F968E4CD3AC01BAC2317A10B16
    SPKI SHA256: CB12DC1499E4457191F8A54B09997E08790F6D1179CBE44237D31D11BB4838D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2023 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7F1F2C6FE8FDB475CA23341F3A858B4E
- SHA-256: B97E1037E4CD5C069271600AFD1FF345EEAE1BC2C023A5FBA8B163260FCA5DAB
- SPKI SHA-256: B97DE80C9FBB0E377BFB8E00939A985157F4DB0B9E9ED94BE866756B0D584586
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:6f:e8:fd:b4:75:ca:23:34:1f:3a:85:8b:4e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 19 03:42:59 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CC:D1:E2:A1:02:A7:E6:6A:5E:EB:1F:F1:6D:D9:46:56:1D:09:E1:47
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B97E1037E4CD5C069271600AFD1FF345EEAE1BC2C023A5FBA8B163260FCA5DAB
    SPKI SHA256: B97DE80C9FBB0E377BFB8E00939A985157F4DB0B9E9ED94BE866756B0D584586
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7FB6A11B8FB012CB7B6F86DD4C6DEAC6
- SHA-256: 60B846638922190DE52C1AB044FD2FA88A9D6DF3989831C00C84296B8DB7A5EE
- SPKI SHA-256: 98916876BB6E977FC62B3CE59F9DABD8063ADE39DAF56A1AA243FD7562596832
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a1:1b:8f:b0:12:cb:7b:6f:86:dd:4c:6d:ea:c6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 18 04:10:11 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                13:71:82:FD:DD:1F:6D:42:77:92:FE:A7:1E:05:E5:FE:BD:AB:09:C1
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 60B846638922190DE52C1AB044FD2FA88A9D6DF3989831C00C84296B8DB7A5EE
    SPKI SHA256: 98916876BB6E977FC62B3CE59F9DABD8063ADE39DAF56A1AA243FD7562596832
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 804E00609073A6031BB16ABC2F385695
- SHA-256: D5816A7FD5FA18D3E0C44C78273FA856BE0A3A993428826763E3A88086311986
- SPKI SHA-256: AFA129C26EC22EEA23722B24141DC61BB363C99EFAE1B77F774F934471B3FB44
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:60:90:73:a6:03:1b:b1:6a:bc:2f:38:56:95
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 17 03:25:02 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:E6:08:FD:98:C0:96:22:4E:48:66:CA:53:6F:2F:69:5E:A5:F6:67
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D5816A7FD5FA18D3E0C44C78273FA856BE0A3A993428826763E3A88086311986
    SPKI SHA256: AFA129C26EC22EEA23722B24141DC61BB363C99EFAE1B77F774F934471B3FB44
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 80E56AEAAF3994480BE63FCDB5E59DD9
- SHA-256: A2A17C92AAB8165D1082C922C541F86ACDB2D691D645BDBB1C9D65EDCD5D56DF
- SPKI SHA-256: 3E767861DD00472D4ECE91A70E5775230DB6335DC941161F66F4699A33CF9196
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:ea:af:39:94:48:0b:e6:3f:cd:b5:e5:9d:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 17 03:17:59 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A2:14:B8:E3:F1:A2:F8:90:0E:2D:D2:7A:26:1E:E0:DF:A4:70:8F:D7
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A2A17C92AAB8165D1082C922C541F86ACDB2D691D645BDBB1C9D65EDCD5D56DF
    SPKI SHA256: 3E767861DD00472D4ECE91A70E5775230DB6335DC941161F66F4699A33CF9196
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2024 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 817CD53C7566CF41D85E6444561EDC1F
- SHA-256: E36857C3D8C985A098F7BEA867DD14C023F62A6195F1CB8CA1632D7A77C6DFD6
- SPKI SHA-256: 15CFE1916BDC72DCF4D696466BF606B8BC5C803B39F8D59765CAC02A34F0222C
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:3c:75:66:cf:41:d8:5e:64:44:56:1e:dc:1f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 17 03:10:12 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                50:60:D2:28:3D:8B:65:7C:95:99:62:86:3E:3C:6A:4B:69:0D:CA:B2
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E36857C3D8C985A098F7BEA867DD14C023F62A6195F1CB8CA1632D7A77C6DFD6
    SPKI SHA256: 15CFE1916BDC72DCF4D696466BF606B8BC5C803B39F8D59765CAC02A34F0222C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 EV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8214416FD1DEFB450D6B0CE74181BAF3
- SHA-256: 248DA0E92BA626B6D8126263A03E09307B444F7770562C1941458BB4D9B16D52
- SPKI SHA-256: CD2C85E8FD93BAEB0FD2EA936973DFE1AC2EFA5F6535BB568035EDCC987FFDB9
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:6f:d1:de:fb:45:0d:6b:0c:e7:41:81:ba:f3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 16 03:08:46 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                51:B4:35:46:09:D9:DB:ED:27:6B:03:85:B5:3D:2F:55:7C:9C:E8:F8
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 248DA0E92BA626B6D8126263A03E09307B444F7770562C1941458BB4D9B16D52
    SPKI SHA256: CD2C85E8FD93BAEB0FD2EA936973DFE1AC2EFA5F6535BB568035EDCC987FFDB9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 EV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 82B76534870E63BAAC5252634B8593B3
- SHA-256: DF4826B20EAA8550A5203A0313C5E1E13B0A389EE584FFD94DDD089329EE0B96
- SPKI SHA-256: 1010A87E0B189B7CECF8139BD0C2A9BA62AAD09E18705CDA00768189F92BBAA4
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:34:87:0e:63:ba:ac:52:52:63:4b:85:93:b3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 22 04:07:04 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:5A:FB:C2:2C:92:60:A3:17:A3:E8:F1:87:2F:DF:F9:39:20:4D:44
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DF4826B20EAA8550A5203A0313C5E1E13B0A389EE584FFD94DDD089329EE0B96
    SPKI SHA256: 1010A87E0B189B7CECF8139BD0C2A9BA62AAD09E18705CDA00768189F92BBAA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 EV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83431C7CAEC823C4C78E6681313817DD
- SHA-256: D5BECFA80B916BD98EC673ACC3EC15FA653E94239D43243EDB4A475EFD932517
- SPKI SHA-256: F35B0DF79BE012D43390CA68A493C9E11400B0DF7683936AF6F3E7A0148F175B
- Validity: 2025-04-16 to 2027-04-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:7c:ae:c8:23:c4:c7:8e:66:81:31:38:17:dd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 16 03:14:51 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:91:60:66:33:39:F2:A7:F7:FB:70:ED:31:E5:5F:DA:44:F4:D3:A3
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D5BECFA80B916BD98EC673ACC3EC15FA653E94239D43243EDB4A475EFD932517
    SPKI SHA256: F35B0DF79BE012D43390CA68A493C9E11400B0DF7683936AF6F3E7A0148F175B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 EV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86DC46EC9B767956C06E22F2D539
- SHA-256: 5AFB7604C3E83F4EC9B2C318353457526A94A4BD076B2AD6AE7BEB64E387C3D0
- SPKI SHA-256: E2769860EC4AD2589BAFBB4EB9327584251809EEFE679C869B49B28C2577945F
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:dc:46:ec:9b:76:79:56:c0:6e:22:f2:d5:39
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:07:14 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1D:33:03:6D:22:8A:C9:15:AF:48:0A:09:BA:5B:C6:02:A6:24:EA:89
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5AFB7604C3E83F4EC9B2C318353457526A94A4BD076B2AD6AE7BEB64E387C3D0
    SPKI SHA256: E2769860EC4AD2589BAFBB4EB9327584251809EEFE679C869B49B28C2577945F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 EV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8471F440AC13BAA304E9CC90505760CA
- SHA-256: C4048268C4A7E5F13457D335FDC072801923246E37F9A6B723BE67A13A5E90CD
- SPKI SHA-256: 803D34B0A6BD4EE4AC27F85E1EDA894A80CFF302813C8E57B2094B00395D268A
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:40:ac:13:ba:a3:04:e9:cc:90:50:57:60:ca
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 15 03:09:50 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                85:EE:70:AC:0E:D8:01:74:EA:63:85:45:F1:DC:91:F1:86:E7:CA:7C
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C4048268C4A7E5F13457D335FDC072801923246E37F9A6B723BE67A13A5E90CD
    SPKI SHA256: 803D34B0A6BD4EE4AC27F85E1EDA894A80CFF302813C8E57B2094B00395D268A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8515040B7ECBA325E57CCD2D87FE63A6
- SHA-256: 397D0205B51C4BC8E26FA10FB3B21141B95738A35AA6CD66F47CF7142DE08B23
- SPKI SHA-256: 5A7DC1D70808B94E5139FCD0636B9208BDA5DBFFC840B98A78DA48F3A11B1307
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:0b:7e:cb:a3:25:e5:7c:cd:2d:87:fe:63:a6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 21 03:00:37 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                11:98:2C:20:42:FF:47:5B:9C:B9:D4:B7:9E:46:EB:60:A9:66:5B:54
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 397D0205B51C4BC8E26FA10FB3B21141B95738A35AA6CD66F47CF7142DE08B23
    SPKI SHA256: 5A7DC1D70808B94E5139FCD0636B9208BDA5DBFFC840B98A78DA48F3A11B1307
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85AC70AEBFE7C80D26E42FEA88DEF910
- SHA-256: 559E925DBA384609A265DADE646904A95CB547BF2BBEEF2A2DF0EEE7EAF7E35B
- SPKI SHA-256: 336007EE593E919CC802961AB1B980E4616E81CC5DB270E65D255EE5C4BB6587
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:ae:bf:e7:c8:0d:26:e4:2f:ea:88:de:f9:10
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 22 03:00:39 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7C:F8:35:02:12:AA:1C:A8:0D:5E:44:CD:B5:0F:05:17:0C:21:6C:D5
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 559E925DBA384609A265DADE646904A95CB547BF2BBEEF2A2DF0EEE7EAF7E35B
    SPKI SHA256: 336007EE593E919CC802961AB1B980E4616E81CC5DB270E65D255EE5C4BB6587
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8643E540F97E8CEC234C34F931445E6B
- SHA-256: 492C4F5FD48258EA53FC520246E6D61000514282E5D489852857246B95A88125
- SPKI SHA-256: F265A8B12691FF31B03A9EB81A39C733FE52D767214744AF131ABA76EF07E0EE
- Validity: 2026-07-22 to 2028-07-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:40:f9:7e:8c:ec:23:4c:34:f9:31:44:5e:6b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 22 03:27:31 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                39:FA:13:65:CD:02:5E:2D:08:34:3E:A0:58:5C:50:66:A1:08:5F:A5
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 492C4F5FD48258EA53FC520246E6D61000514282E5D489852857246B95A88125
    SPKI SHA256: F265A8B12691FF31B03A9EB81A39C733FE52D767214744AF131ABA76EF07E0EE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 EV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 EV TLS CA H2 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 7A29854076B321FAF80199AD45C50B07
- SHA-256: 385AA00A1848F807F665561E888B0D4F69614052D825F3C33970E00F4C3658DD
- SPKI SHA-256: EA48FF8DF484EE1A0042389E68CD18ADE622F8D536E5D7D55B85F912F3DEB7E7
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46evtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:40:76:b3:21:fa:f8:01:99:ad:45:c5:0b:07
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 EV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:78:B1:75:A2:C0:9F:9D:0C:AA:09:D2:04:77:41:8A:9E:53:31:69
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 385AA00A1848F807F665561E888B0D4F69614052D825F3C33970E00F4C3658DD
    SPKI SHA256: EA48FF8DF484EE1A0042389E68CD18ADE622F8D536E5D7D55B85F912F3DEB7E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R46 OV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2025 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83431C90E07C466605343FD248C0AB25
- SHA-256: 34998966ECD3590372583EE14C6DDAFD4A773E842F5224761C1F1113D84056A8
- SPKI SHA-256: 9166A069DF3DA84068ACE452375DAAB68CF2B69960422840A6BEC7FA9DC46ECA
- Validity: 2025-04-16 to 2027-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46ovtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:90:e0:7c:46:66:05:34:3f:d2:48:c0:ab:25
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 16 03:15:07 2025 GMT
            Not After : Jun 30 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8A:5D:ED:6F:60:CC:44:E6:35:00:1F:86:A8:79:33:36:17:8E:F0:37
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 34998966ECD3590372583EE14C6DDAFD4A773E842F5224761C1F1113D84056A8
    SPKI SHA256: 9166A069DF3DA84068ACE452375DAAB68CF2B69960422840A6BEC7FA9DC46ECA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 OV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2025 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 83DA86ED9460F0B10957AC3127B14EEB
- SHA-256: 3129A7F1680E439FC9DDCBC3539103FA17CB7236461A5310351DE442D05446BB
- SPKI SHA-256: D0CA7C2416DE23AA118B629CD5ACB3F072D33F4F79B2FBC7B33F550A280AE8CC
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46ovtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:ed:94:60:f0:b1:09:57:ac:31:27:b1:4e:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 16 03:07:28 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B9:B4:F0:3F:E7:EF:5F:33:14:7D:B9:EC:94:EA:A9:80:0E:76:F5:50
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3129A7F1680E439FC9DDCBC3539103FA17CB7236461A5310351DE442D05446BB
    SPKI SHA256: D0CA7C2416DE23AA118B629CD5ACB3F072D33F4F79B2FBC7B33F550A280AE8CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R46 OV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8471F4557E267898AEE98959ED953630
- SHA-256: 76B9CAA3BB48D101980541091F920BDC5CC5F1B7C909C29BF6C31C629E6C1C3A
- SPKI SHA-256: 9F2FB470E0DF343A4F60ECE1FACDD153FFEB4D15EC8E31113A0E946A1DEF68E8
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46ovtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:55:7e:26:78:98:ae:e9:89:59:ed:95:36:30
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Oct 15 03:10:06 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                67:33:81:E4:B3:5E:64:CC:54:33:69:CF:1D:2A:DA:F5:86:7D:C3:5E
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 76B9CAA3BB48D101980541091F920BDC5CC5F1B7C909C29BF6C31C629E6C1C3A
    SPKI SHA256: 9F2FB470E0DF343A4F60ECE1FACDD153FFEB4D15EC8E31113A0E946A1DEF68E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 OV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8515041EC7A4A13CCFF4565CBB886FC6
- SHA-256: 8A84356F9D4F28BE327B9FF2F0636BDFBE52660D013C4239EDBE7CCD7D79DF71
- SPKI SHA-256: 6CF4C6428FA974662C5404CDEA0B2C7B53047D4A292B6EA7FB648ACBF9F197F2
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46ovtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:04:1e:c7:a4:a1:3c:cf:f4:56:5c:bb:88:6f:c6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jan 21 03:00:52 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:53:AF:9E:DD:A0:C7:49:A2:EB:8D:FE:35:7B:C1:D3:2E:9D:CE:D2
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8A84356F9D4F28BE327B9FF2F0636BDFBE52660D013C4239EDBE7CCD7D79DF71
    SPKI SHA256: 6CF4C6428FA974662C5404CDEA0B2C7B53047D4A292B6EA7FB648ACBF9F197F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 OV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85AC70C49C4BCED3DEBF905F68BB42A4
- SHA-256: 374919F5BB4634D180E3A9FA4AB849B85912BF4169D4A4610EE5F9DC1C18D960
- SPKI SHA-256: 94DA228B3961237130962DC389B0377018FA71ADB4B470F4EB3F95F3E563654F
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr46ovtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:c4:9c:4b:ce:d3:de:bf:90:5f:68:bb:42:a4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 22 03:00:57 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E3:4B:DA:BC:6D:AB:D7:55:B2:44:92:BE:60:D4:71:24:84:6B:B3:51
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 374919F5BB4634D180E3A9FA4AB849B85912BF4169D4A4610EE5F9DC1C18D960
    SPKI SHA256: 94DA228B3961237130962DC389B0377018FA71ADB4B470F4EB3F95F3E563654F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R46 OV TLS CA 2026 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R46 OV TLS CA 2026 Q4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8643E54D6CAA2982B4FAC6CD29097E25
- SHA-256: 2F62671994E4E3ABBAA0DCB27DE82582EEE953FF29EE75002EB2B8D34551A53A
- SPKI SHA-256: 3684CCFD7E6C5D47F13C80821A803093EF4EDE68C1C837CE8A4F38C8793D1640
- Validity: 2026-07-22 to 2028-07-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:4d:6c:aa:29:82:b4:fa:c6:cd:29:09:7e:25
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Jul 22 03:27:41 2026 GMT
            Not After : Jul 21 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R46 OV TLS CA 2026 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:E8:6E:3C:D8:AF:1D:C7:AB:E8:3A:45:12:7D:8E:69:FE:67:59:9A
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2F62671994E4E3ABBAA0DCB27DE82582EEE953FF29EE75002EB2B8D34551A53A
    SPKI SHA256: 3684CCFD7E6C5D47F13C80821A803093EF4EDE68C1C837CE8A4F38C8793D1640
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 AATL CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 AATL CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 784AAA8B37B61DDAC065FDD01FA0C292
- SHA-256: 96D0E059827A7C99BA5CF586D1B77397A3C83777C467BF1914762AE16ABE3834
- SPKI SHA-256: 87EAC602A9D716EE4F4FEE3AA4B96C79E1A10020FF47F0DA37A30B8C962C45C4
- Validity: 2020-12-09 to 2022-03-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6aatlca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:8b:37:b6:1d:da:c0:65:fd:d0:1f:a0:c2:92
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Mar  9 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 AATL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E0:62:03:47:13:7C:3A:2B:54:B4:16:44:44:25:65:8E:F5:44:82:ED
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 96D0E059827A7C99BA5CF586D1B77397A3C83777C467BF1914762AE16ABE3834
    SPKI SHA256: 87EAC602A9D716EE4F4FEE3AA4B96C79E1A10020FF47F0DA37A30B8C962C45C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803182AFBECD89EB19309BB4A25BDAA
- SHA-256: BCE7091355D2417A37F8CFE2AC8F17C2748888BA0EEA90000FC980ECFC2D041F
- SPKI SHA-256: 3FBC675922D0560E9FFCC31A45EF9FF53040C033A5C1DA32C707951B1F2FDA16
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:2a:fb:ec:d8:9e:b1:93:09:bb:4a:25:bd:aa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                84:DC:21:0B:C7:A8:5D:72:97:84:87:7E:F2:D5:B6:FA:71:56:4E:FB
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BCE7091355D2417A37F8CFE2AC8F17C2748888BA0EEA90000FC980ECFC2D041F
    SPKI SHA256: 3FBC675922D0560E9FFCC31A45EF9FF53040C033A5C1DA32C707951B1F2FDA16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 EV TLS CA 2022 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7AFB3395C19C9A5FB41C48698DE9442F
- SHA-256: C9A74009DAE194A40BD122ABD015D44E93CB7879B0949054A31042EF4C99E5D6
- SPKI SHA-256: C677FD8B6BFB4B2AE2D41DC24F0A75C4510DA5A77E44170C3BB15E118C3DF4DE
- Validity: 2021-10-20 to 2024-10-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2022q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:fb:33:95:c1:9c:9a:5f:b4:1c:48:69:8d:e9:44:2f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 20 12:00:00 2021 GMT
            Not After : Oct 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2022 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                92:45:BA:EC:35:E9:29:C6:CA:34:36:93:81:5B:78:0B:4A:5E:A7:6E
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C9A74009DAE194A40BD122ABD015D44E93CB7879B0949054A31042EF4C99E5D6
    SPKI SHA256: C677FD8B6BFB4B2AE2D41DC24F0A75C4510DA5A77E44170C3BB15E118C3DF4DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2022 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B9E420BF799332BB0D48DCAD9839395
- SHA-256: 256602DC8A8041B2EDC0CAE611A6A98D9B39AD4DE3E19F62DC0A0A1958B72271
- SPKI SHA-256: 38DD83C0522514E8DFC71CA9533EBB439CC08DB82B58A6576AB75B3B032F64ED
- Validity: 2022-01-26 to 2025-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2022q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:9e:42:0b:f7:99:33:2b:b0:d4:8d:ca:d9:83:93:95
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 26 12:00:00 2022 GMT
            Not After : Jan 26 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2022 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                97:F5:F1:26:66:20:73:27:08:18:2E:F4:50:7B:8A:78:06:88:6A:47
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 256602DC8A8041B2EDC0CAE611A6A98D9B39AD4DE3E19F62DC0A0A1958B72271
    SPKI SHA256: 38DD83C0522514E8DFC71CA9533EBB439CC08DB82B58A6576AB75B3B032F64ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2022 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C395862A7224ECDFC49321E9387
- SHA-256: 0C92594BD394B4887A1D66EC5E631FFAD3BA4B07FE2EB6D15D2F5FEE4C90C454
- SPKI SHA-256: AF47E09A67D070FB753A4ABDC58D14C32CAE0D4B4A16CDA755063D93AF11CB36
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2022q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:39:58:62:a7:22:4e:cd:fc:49:32:1e:93:87
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2022 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A5:B8:F5:7E:E2:3D:F6:97:26:C3:6E:51:40:CE:F2:18:39:0D:2F:95
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0C92594BD394B4887A1D66EC5E631FFAD3BA4B07FE2EB6D15D2F5FEE4C90C454
    SPKI SHA256: AF47E09A67D070FB753A4ABDC58D14C32CAE0D4B4A16CDA755063D93AF11CB36
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2022 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2022 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7CC174E066F4949577D754D14EDBEA56
- SHA-256: C1262AC6412075B2513AE5E563FCCEDB4B3E59B812695EE0CD87223A2C2D048B
- SPKI SHA-256: 4684CD126F6FF4DED12DC2E3FBAEC38E4A512DE9CF293AC9AC97CF019FB69342
- Validity: 2022-07-20 to 2024-07-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2022q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c1:74:e0:66:f4:94:95:77:d7:54:d1:4e:db:ea:56
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 20 03:25:53 2022 GMT
            Not After : Jul 20 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2022 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:E1:4B:46:CA:ED:66:62:81:73:62:C9:5E:BE:31:40:0E:49:A5:A3
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C1262AC6412075B2513AE5E563FCCEDB4B3E59B812695EE0CD87223A2C2D048B
    SPKI SHA256: 4684CD126F6FF4DED12DC2E3FBAEC38E4A512DE9CF293AC9AC97CF019FB69342
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2023 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D4D4261CA9B9C7A485A46EECDE1C8F0
- SHA-256: 1083D57464FD5128B80B22965FA205E13168DDFCCDF17A7095F3BE0ED0AB3A91
- SPKI SHA-256: 89D4C834C906717DEF90F45E037324B90C12AB99BD5974F6FD20BC9FF340A0E8
- Validity: 2022-10-12 to 2024-10-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2023q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4d:42:61:ca:9b:9c:7a:48:5a:46:ee:cd:e1:c8:f0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 12 03:48:47 2022 GMT
            Not After : Oct 12 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2023 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                57:F4:7F:FA:33:33:8E:40:0E:CF:FE:6E:20:7D:7A:92:58:C1:98:1E
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1083D57464FD5128B80B22965FA205E13168DDFCCDF17A7095F3BE0ED0AB3A91
    SPKI SHA256: 89D4C834C906717DEF90F45E037324B90C12AB99BD5974F6FD20BC9FF340A0E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2023 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7DF05176D8516685F2E7C3477A87846B
- SHA-256: AEDCC1DBCB44D96F692BD451D76A3229839151D5BE82FE8D0D1B23030F48FB19
- SPKI SHA-256: 58A6A0771687DB1E7743294523AA3A2DACE072850A52FBE367DCDB78E44B136F
- Validity: 2023-01-18 to 2025-01-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2023q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:f0:51:76:d8:51:66:85:f2:e7:c3:47:7a:87:84:6b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 18 03:37:10 2023 GMT
            Not After : Jan 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2023 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                97:B9:DB:4E:61:87:53:15:4A:93:5F:FA:65:AB:74:02:FD:BE:7D:6D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AEDCC1DBCB44D96F692BD451D76A3229839151D5BE82FE8D0D1B23030F48FB19
    SPKI SHA256: 58A6A0771687DB1E7743294523AA3A2DACE072850A52FBE367DCDB78E44B136F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2023 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C2AF6A3E2D7BC7622EDCDE7C275F
- SHA-256: D454487FBE3B2CBC10C3023E73AEE27F3E3640726CE7BB03BB4244B50CB2F4C4
- SPKI SHA-256: 0423045EA424B475AE9ADFE9EE84F6D904E0E5CEB0B6036C9E8ED1BE5448C4D6
- Validity: 2023-04-19 to 2025-04-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2023q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c2:af:6a:3e:2d:7b:c7:62:2e:dc:de:7c:27:5f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:52:42 2023 GMT
            Not After : Apr 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2023 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EB:F3:7C:20:11:69:01:DC:DA:51:E6:CF:D1:00:D3:0D:73:70:1B:D9
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D454487FBE3B2CBC10C3023E73AEE27F3E3640726CE7BB03BB4244B50CB2F4C4
    SPKI SHA256: 0423045EA424B475AE9ADFE9EE84F6D904E0E5CEB0B6036C9E8ED1BE5448C4D6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2023 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2023 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C5692FBFD55E8C43D7B4D25DC0A
- SHA-256: 4959306BAE8C548D319D1855C34493F7AD00B9BAF824BDFD96FF2C3C32BDAEEA
- SPKI SHA-256: 34B74B1B09DABAD45046776C49E03E10D66F2D7B95BB094255166F97927AF5BA
- Validity: 2023-07-19 to 2025-07-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2023q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:56:92:fb:fd:55:e8:c4:3d:7b:4d:25:dc:0a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:42:39 2023 GMT
            Not After : Jul 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2023 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:AF:FC:1E:00:2C:D6:3D:7F:1C:84:00:F8:2F:64:1D:47:3E:DB:87
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4959306BAE8C548D319D1855C34493F7AD00B9BAF824BDFD96FF2C3C32BDAEEA
    SPKI SHA256: 34B74B1B09DABAD45046776C49E03E10D66F2D7B95BB094255166F97927AF5BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2024 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FB6A0FED0D8E71004BD9D3B89DB0137
- SHA-256: 020EEC98A3C1ED2D5BE21193349ACB9751DE071D6B452A489A6A867CE9B633E9
- SPKI SHA-256: BC9FA6E1D35DA73D958E3517140A7E4DF1DEF8B10B80DEE94CBFF9F7B854C0E6
- Validity: 2023-10-18 to 2025-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2024q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:b6:a0:fe:d0:d8:e7:10:04:bd:9d:3b:89:db:01:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 18 04:09:48 2023 GMT
            Not After : Oct 18 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2024 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6C:FB:92:F4:BC:AA:37:08:95:78:7F:41:32:61:8C:28:5E:67:09:3F
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 020EEC98A3C1ED2D5BE21193349ACB9751DE071D6B452A489A6A867CE9B633E9
    SPKI SHA256: BC9FA6E1D35DA73D958E3517140A7E4DF1DEF8B10B80DEE94CBFF9F7B854C0E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2024 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 804E004861584C7EF79E31B7661D30EF
- SHA-256: 91DDDCB95C82585A3D8645F665CE7B8B606569F6941D33BD9DDA338A5EF6D4C2
- SPKI SHA-256: F18A73439FD2D2464E6EF9D79F315C88AEB8F7502DF4F8268FC53DB4C7D37CB5
- Validity: 2024-01-17 to 2026-01-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2024q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:4e:00:48:61:58:4c:7e:f7:9e:31:b7:66:1d:30:ef
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 17 03:24:43 2024 GMT
            Not After : Jan 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2024 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2D:16:CB:CB:82:4B:4B:68:5F:F9:D6:34:6F:37:A2:2D:14:F6:BC:EF
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 91DDDCB95C82585A3D8645F665CE7B8B606569F6941D33BD9DDA338A5EF6D4C2
    SPKI SHA256: F18A73439FD2D2464E6EF9D79F315C88AEB8F7502DF4F8268FC53DB4C7D37CB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2024 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80E56AD26CDFA17C6D6B3A3E70179D9F
- SHA-256: 5F8BAA9B8D5DB1707D56F07E1B44D77D84EF0CA6923B6B44B7CF47AD9C47EECF
- SPKI SHA-256: 5F61C0A787C1DF49237798AE38C34657BD7422CB8A52EDEDCB4FD2CD976CF13C
- Validity: 2024-04-17 to 2026-04-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2024q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6a:d2:6c:df:a1:7c:6d:6b:3a:3e:70:17:9d:9f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 17 03:17:40 2024 GMT
            Not After : Apr 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2024 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                74:BB:1E:BF:04:DC:F0:DF:8F:B4:3B:53:3D:29:F8:C9:12:64:67:72
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5F8BAA9B8D5DB1707D56F07E1B44D77D84EF0CA6923B6B44B7CF47AD9C47EECF
    SPKI SHA256: 5F61C0A787C1DF49237798AE38C34657BD7422CB8A52EDEDCB4FD2CD976CF13C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2024 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2024 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 817CD52EF40AD9977682EA0014A53512
- SHA-256: 9F58EDC769BF0C9A0AC6C9926CB0EF43EE6AE04D8C2879A0F5E0E10AC53E6329
- SPKI SHA-256: 621A1675FDD0A4ECD1957CB674EC717FB713F35E748AE5427E5F4F31D61DD333
- Validity: 2024-07-17 to 2026-07-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2024q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7c:d5:2e:f4:0a:d9:97:76:82:ea:00:14:a5:35:12
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 17 03:10:01 2024 GMT
            Not After : Jul 17 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2024 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B4:33:75:4F:09:F8:CF:E7:C9:9B:54:B3:A1:2E:0D:FA:9D:2B:40:F6
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9F58EDC769BF0C9A0AC6C9926CB0EF43EE6AE04D8C2879A0F5E0E10AC53E6329
    SPKI SHA256: 621A1675FDD0A4ECD1957CB674EC717FB713F35E748AE5427E5F4F31D61DD333
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 EV TLS CA 2025 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82144150865F1026CB8DD3768AB14863
- SHA-256: A57DFD8D12E0334FDC85D2D62066B410FBE49FA241A4CC0B16087E732351B349
- SPKI SHA-256: 9077AEDC6086394F2DB6B3301DEFFEEB118155D4B0DDDDB2E1754C41CC3E9EE4
- Validity: 2024-10-16 to 2026-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2025q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:14:41:50:86:5f:10:26:cb:8d:d3:76:8a:b1:48:63
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 16 03:08:21 2024 GMT
            Not After : Oct 16 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2025 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                82:AA:DA:7E:04:BD:8E:4E:BA:D2:1C:F4:11:49:5C:2E:21:B1:D0:22
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A57DFD8D12E0334FDC85D2D62066B410FBE49FA241A4CC0B16087E732351B349
    SPKI SHA256: 9077AEDC6086394F2DB6B3301DEFFEEB118155D4B0DDDDB2E1754C41CC3E9EE4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R6 EV TLS CA 2025 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 82B7651A8A98F141F957D9251671EC25
- SHA-256: A1CA27EDDB7B7CB597BF3D82612063474000BB9108C67B3D5F9B7C55C5D6002C
- SPKI SHA-256: 5CCFF1BB307636672866CDFB1595645037B1E9E4E55F32077B9F89397B8E7520
- Validity: 2025-01-22 to 2027-01-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2025q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b7:65:1a:8a:98:f1:41:f9:57:d9:25:16:71:ec:25
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 04:06:44 2025 GMT
            Not After : Jan 22 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2025 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:48:D6:10:82:8C:9E:29:62:9B:68:3A:7B:C1:1A:8D:3A:06:0F:9D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A1CA27EDDB7B7CB597BF3D82612063474000BB9108C67B3D5F9B7C55C5D6002C
    SPKI SHA256: 5CCFF1BB307636672866CDFB1595645037B1E9E4E55F32077B9F89397B8E7520
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R6 EV TLS CA 2025 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83431C6223C1770B55F1BD52C438BF85
- SHA-256: D0901497DB8C9FA8D9B84431A8A5B2D3F00E237EA1FE767C3F4F66A8B14302F1
- SPKI SHA-256: BA54ACFA035309E3E2009E3815EDA18F2BC7DD94ED6FBFAEC1B4254B2E3CF1AE
- Validity: 2025-04-16 to 2027-04-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2025q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1c:62:23:c1:77:0b:55:f1:bd:52:c4:38:bf:85
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 16 03:14:30 2025 GMT
            Not After : Apr 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2025 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:35:43:72:F8:F8:6A:74:85:14:3E:86:6E:52:E2:3F:B9:8C:CA:3A
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D0901497DB8C9FA8D9B84431A8A5B2D3F00E237EA1FE767C3F4F66A8B14302F1
    SPKI SHA256: BA54ACFA035309E3E2009E3815EDA18F2BC7DD94ED6FBFAEC1B4254B2E3CF1AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R6 EV TLS CA 2025 Q4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2025 Q4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA86C1583F14D3C1E0D1A6F2DF29A0
- SHA-256: 4E6B95E7142558AEC2CEAFCC0593321498C899107366F0A89A916FA55BDA8C2E
- SPKI SHA-256: 0D2E180EDEFC87FFE4CFD4D501F6F587B413C743D01DF564C4653D88EA9164E1
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2025q4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:c1:58:3f:14:d3:c1:e0:d1:a6:f2:df:29:a0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:06:53 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2025 Q4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7B:64:B8:98:E8:30:3A:D3:3B:CD:02:DB:0B:9A:93:2D:38:AE:05:7B
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4E6B95E7142558AEC2CEAFCC0593321498C899107366F0A89A916FA55BDA8C2E
    SPKI SHA256: 0D2E180EDEFC87FFE4CFD4D501F6F587B413C743D01DF564C4653D88EA9164E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Atlas R6 EV TLS CA 2026 LT

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 LT
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8643E565CABB4618E88CB38CA9E2B5D8
- SHA-256: 1D4B2C5BDB9EF2A743B73D7F455598DC91CF7E12BBC90FB6B49144546E4BEBF8
- SPKI SHA-256: F753436D522D22DE34DA8EE1F91659D018048B28A96DE43160EE09DB7A7409FD
- Validity: 2026-07-22 to 2029-07-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:43:e5:65:ca:bb:46:18:e8:8c:b3:8c:a9:e2:b5:d8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 22 03:28:00 2026 GMT
            Not After : Jul 21 12:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2026 LT
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5A:3F:79:D3:5C:C3:34:79:E8:8A:7C:F1:5F:0A:63:23:5B:05:EE:26
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1D4B2C5BDB9EF2A743B73D7F455598DC91CF7E12BBC90FB6B49144546E4BEBF8
    SPKI SHA256: F753436D522D22DE34DA8EE1F91659D018048B28A96DE43160EE09DB7A7409FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 EV TLS CA 2026 Q1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q1
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F4279882352A565000A05C30BB3C
- SHA-256: 4BBD0ADC43CF8B3EE5F3DA75A1C2373283A30B08D66C22786CE137110B71FFBB
- SPKI SHA-256: 08D76C921692066DC785BB28A1D863F5686ACA670E6E32ADBEDBA8C170CBE5A6
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2026q1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:27:98:82:35:2a:56:50:00:a0:5c:30:bb:3c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:09:30 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2026 Q1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:AB:AB:16:4F:9F:BA:85:B1:24:8F:31:CC:09:C9:78:17:16:0E:59
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4BBD0ADC43CF8B3EE5F3DA75A1C2373283A30B08D66C22786CE137110B71FFBB
    SPKI SHA256: 08D76C921692066DC785BB28A1D863F5686ACA670E6E32ADBEDBA8C170CBE5A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 EV TLS CA 2026 Q2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 851503F268EB1B0A66E3AB657CA732FC
- SHA-256: 7E848DE198F87E3E34AC956F97AF133A0A442776B481A2978F0514FBEBADA511
- SPKI SHA-256: A76F8C5A2CC343A729E0D284389490834B7D9555F1804B511469190196A1AF43
- Validity: 2026-01-21 to 2028-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2026q2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:f2:68:eb:1b:0a:66:e3:ab:65:7c:a7:32:fc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 21 03:00:17 2026 GMT
            Not After : Jan 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2026 Q2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B1:C7:8F:42:8B:1B:9A:CB:C1:89:F1:7D:20:20:BF:0E:54:25:C6:EF
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7E848DE198F87E3E34AC956F97AF133A0A442776B481A2978F0514FBEBADA511
    SPKI SHA256: A76F8C5A2CC343A729E0D284389490834B7D9555F1804B511469190196A1AF43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 EV TLS CA 2026 Q3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA 2026 Q3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 85AC7096CA939917D22202F298711896
- SHA-256: 17EA86A6E2FF7BEBEC55411556E9BBBAF9CB76C1CAFC5B89A5831C10743F9B27
- SPKI SHA-256: 7537B31AE86A4B3EB9255DF6B97AF0AF73F51DB8D2A211702E425DA915C34DC8
- Validity: 2026-04-22 to 2028-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlsca2026q3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:96:ca:93:99:17:d2:22:02:f2:98:71:18:96
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 22 03:00:20 2026 GMT
            Not After : Apr 22 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA 2026 Q3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                34:F9:49:28:41:3A:39:79:1F:0C:12:FF:BD:29:F1:16:FF:25:46:30
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 17EA86A6E2FF7BEBEC55411556E9BBBAF9CB76C1CAFC5B89A5831C10743F9B27
    SPKI SHA256: 7537B31AE86A4B3EB9255DF6B97AF0AF73F51DB8D2A211702E425DA915C34DC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Atlas R6 EV TLS CA H2 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 EV TLS CA H2 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A2985274CE25AD3411FD59DBC65ACC1
- SHA-256: 0ABB1CDE53CCAC170483DAFCD3CDB9F2622BA7E47D31EC0FD3DB271B4AAA5303
- SPKI SHA-256: D26BF3A2113D86C836089C1086B3EEBA60F6A08ECCBC00D28DC74CDC8867A95E
- Validity: 2021-06-16 to 2024-06-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6evtlscah22021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:29:85:27:4c:e2:5a:d3:41:1f:d5:9d:bc:65:ac:c1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 16 12:00:00 2021 GMT
            Not After : Jun 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 EV TLS CA H2 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                92:0A:7F:A7:9E:29:42:9D:ED:DA:2D:3A:53:F4:DA:AB:77:C7:F9:16
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0ABB1CDE53CCAC170483DAFCD3CDB9F2622BA7E47D31EC0FD3DB271B4AAA5303
    SPKI SHA256: D26BF3A2113D86C836089C1086B3EEBA60F6A08ECCBC00D28DC74CDC8867A95E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Atlas R6 SMIME CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Atlas R6 SMIME CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C301522AD22646E4E93E999093D9
- SHA-256: 4A50CA65DB216AD62D260C5EC1D9CAE225E7BF961329817E0E93B97DEC3D277C
- SPKI SHA-256: ED40582F6EB234CEAF81EE5B8156E18A897111AA24AFF1F3A57B579470BD1B3B
- Validity: 2023-04-19 to 2032-04-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsatlasr6smimeca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c3:01:52:2a:d2:26:46:e4:e9:3e:99:90:93:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:53:47 2023 GMT
            Not After : Apr 19 00:00:00 2032 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Atlas R6 SMIME CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                33:BA:BE:A3:D4:39:4D:2A:19:D7:C8:66:92:68:81:FD:C1:C6:C9:C6
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4A50CA65DB216AD62D260C5EC1D9CAE225E7BF961329817E0E93B97DEC3D277C
    SPKI SHA256: ED40582F6EB234CEAF81EE5B8156E18A897111AA24AFF1F3A57B579470BD1B3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CA 2 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 2 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45E6B7AFDCA671BDB65D14F3DAC0
- SHA-256: A13820A7387BDFAD204463EFA9216416639B7E73C31DC2F499F53FCD4D4D25C4
- SPKI SHA-256: 5545EE24B1BB6ABB9CA7C155F2941E3317F0D1A6CA856FD2B33C9C0DB80F1A78
- Validity: 2014-12-10 to 2024-12-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:e6:b7:af:dc:a6:71:bd:b6:5d:14:f3:da:c0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec 10 00:00:00 2014 GMT
            Not After : Dec 10 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 2 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C5:13:4E:CE:87:C6:89:1B:23:E8:40:E3:75:32:9B:03:70:3A:EF:EF
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A13820A7387BDFAD204463EFA9216416639B7E73C31DC2F499F53FCD4D4D25C4
    SPKI SHA256: 5545EE24B1BB6ABB9CA7C155F2941E3317F0D1A6CA856FD2B33C9C0DB80F1A78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign CA 2 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 2 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45D3E5C0C2BDAA7A9DF7817AB6C1
- SHA-256: 7525B1840C398E295FF3AEC5A45BD951B615E9AA26B890319C3BF5CBA95F2441
- SPKI SHA-256: 5545EE24B1BB6ABB9CA7C155F2941E3317F0D1A6CA856FD2B33C9C0DB80F1A78
- Validity: 2014-11-25 to 2024-11-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:d3:e5:c0:c2:bd:aa:7a:9d:f7:81:7a:b6:c1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Nov 25 10:00:00 2014 GMT
            Not After : Nov 25 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 2 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C5:13:4E:CE:87:C6:89:1B:23:E8:40:E3:75:32:9B:03:70:3A:EF:EF
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7525B1840C398E295FF3AEC5A45BD951B615E9AA26B890319C3BF5CBA95F2441
    SPKI SHA256: 5545EE24B1BB6ABB9CA7C155F2941E3317F0D1A6CA856FD2B33C9C0DB80F1A78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_tbs_signature_rsa_encryption_parameter_not_null: certificate tbsCertificate.signature RSA algorithm identifier missing required NULL parameter

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign CA 3 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 3 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45D3E5C49AFCE8834A6E40E4DB10
- SHA-256: AB68685567BF68819CD163933CDEF86BCD447AEB21404B97D9DA7B57C8449179
- SPKI SHA-256: 448E0E470C1BAF3EE24CAF81B9BEA01B0F4DD726B1C0163691DC7C740017281A
- Validity: 2014-11-25 to 2024-11-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:d3:e5:c4:9a:fc:e8:83:4a:6e:40:e4:db:10
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Nov 25 10:00:00 2014 GMT
            Not After : Nov 25 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 3 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F1:E2:AD:96:D6:A6:CB:34:45:21:0C:62:5D:37:16:6B:13:1A:8C:B8
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB68685567BF68819CD163933CDEF86BCD447AEB21404B97D9DA7B57C8449179
    SPKI SHA256: 448E0E470C1BAF3EE24CAF81B9BEA01B0F4DD726B1C0163691DC7C740017281A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_tbs_signature_rsa_encryption_parameter_not_null: certificate tbsCertificate.signature RSA algorithm identifier missing required NULL parameter

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign CA 3 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 3 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 45E6B7C3ECFD4BA24B31E9ABF085
- SHA-256: C01963059070CB2306F4B486CCF1503359209E98499C810C2B49E26E31A4BD74
- SPKI SHA-256: 448E0E470C1BAF3EE24CAF81B9BEA01B0F4DD726B1C0163691DC7C740017281A
- Validity: 2014-12-10 to 2024-12-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:e6:b7:c3:ec:fd:4b:a2:4b:31:e9:ab:f0:85
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec 10 00:00:00 2014 GMT
            Not After : Dec 10 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 3 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F1:E2:AD:96:D6:A6:CB:34:45:21:0C:62:5D:37:16:6B:13:1A:8C:B8
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C01963059070CB2306F4B486CCF1503359209E98499C810C2B49E26E31A4BD74
    SPKI SHA256: 448E0E470C1BAF3EE24CAF81B9BEA01B0F4DD726B1C0163691DC7C740017281A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign CA 4 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 4 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01F240474AD26377CF051B2B27
- SHA-256: EBA34C7B109671614C367E1DE075124C3954CE19F85FACF61090EC319F7F1A7F
- SPKI SHA-256: 5E3D0EA6228CE5F909EE0FFFA5F517B0A9E9F46833DC268080863A414FCC97A2
- Validity: 2019-02-20 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, E-mail Protection, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.30.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:47:4a:d2:63:77:cf:05:1b:2b:27
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Feb 20 00:00:00 2019 GMT
            Not After : Feb 20 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 4 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, E-mail Protection, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                06:0A:18:DF:42:61:AA:B7:BC:0F:E8:D4:17:85:0C:BD:BA:71:E0:B0
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.40.30.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EBA34C7B109671614C367E1DE075124C3954CE19F85FACF61090EC319F7F1A7F
    SPKI SHA256: 5E3D0EA6228CE5F909EE0FFFA5F517B0A9E9F46833DC268080863A414FCC97A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, E-mail Protection, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.30.2
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CA 4 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 4 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01E9D8A4BBB63A3EBA7AA8F597
- SHA-256: 9DDC2E0D55B461E0C73228282DF56B2BEF224CA2385681D17B6E8C077852573C
- SPKI SHA-256: 5E3D0EA6228CE5F909EE0FFFA5F517B0A9E9F46833DC268080863A414FCC97A2
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:bb:b6:3a:3e:ba:7a:a8:f5:97
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Apr 18 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 4 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                06:0A:18:DF:42:61:AA:B7:BC:0F:E8:D4:17:85:0C:BD:BA:71:E0:B0
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9DDC2E0D55B461E0C73228282DF56B2BEF224CA2385681D17B6E8C077852573C
    SPKI SHA256: 5E3D0EA6228CE5F909EE0FFFA5F517B0A9E9F46833DC268080863A414FCC97A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CA 5 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 5 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01E9D8A4C18E00D0342C03C730
- SHA-256: 306E9739E3458FF4546877B704B2E3905E58B235D64E32F4F026AC91B7295D15
- SPKI SHA-256: 420571591E4DB27B88EF1E8628697156C4072BB9839626CC66281DCF0DAAB315
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:c1:8e:00:d0:34:2c:03:c7:30
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Apr 18 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 5 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                65:E5:5D:4C:DD:3D:43:70:BC:A2:9C:49:26:6F:F6:E8:C2:97:5B:CB
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 306E9739E3458FF4546877B704B2E3905E58B235D64E32F4F026AC91B7295D15
    SPKI SHA256: 420571591E4DB27B88EF1E8628697156C4072BB9839626CC66281DCF0DAAB315
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CA 6 for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA 6 for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G3
- Serial: 7653FE6201160C076541169833C35C23
- SHA-256: BE1FFC0E1FF6088104F43E327E7C7DC72A9CA7B0DF05793123ABE32DEACEE76F
- SPKI SHA-256: 4FF08F5580A23EE30B1102073EF68657A5D6BF95CDED23D2BF3BAED884E020F0
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g3
- CRL DP: http://crl.globalsign.com/gsaatlsha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:62:01:16:0c:07:65:41:16:98:33:c3:5c:23
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G3
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA 6 for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                15:28:65:FF:31:05:F7:9F:89:3D:9A:BE:C3:D6:95:E4:C4:8C:71:A5
            X509v3 Authority Key Identifier:
                60:FE:AE:A7:CF:D3:1B:44:B1:12:2A:E6:6C:58:86:1D:11:AB:B2:3B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlsha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BE1FFC0E1FF6088104F43E327E7C7DC72A9CA7B0DF05793123ABE32DEACEE76F
    SPKI SHA256: 4FF08F5580A23EE30B1102073EF68657A5D6BF95CDED23D2BF3BAED884E020F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlsha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CA for AATL - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001444F0236B6
- SHA-256: AA89C466E9D06882C0DAAF72BE0F0FBCFE7C1EF2AAAD190640C4AD44F5517F34
- SPKI SHA-256: 026F0A8E207F05F1F172DB713DC22D0F43C8FF0D69724AA6FAC6A8393DF62508
- Validity: 2014-02-20 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4f:02:36:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Mar 18 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA89C466E9D06882C0DAAF72BE0F0FBCFE7C1EF2AAAD190640C4AD44F5517F34
    SPKI SHA256: 026F0A8E207F05F1F172DB713DC22D0F43C8FF0D69724AA6FAC6A8393DF62508
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign CA for AATL - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000133A787FEAC
- SHA-256: 3AAEB26CFCADB77814E34512616232A687D186A84303AA0C8DBBE492CEBD94A1
- SPKI SHA-256: 026F0A8E207F05F1F172DB713DC22D0F43C8FF0D69724AA6FAC6A8393DF62508
- Validity: 2011-11-15 to 2022-11-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:a7:87:fe:ac
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 15 12:00:00 2011 GMT
            Not After : Nov 15 12:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3AAEB26CFCADB77814E34512616232A687D186A84303AA0C8DBBE492CEBD94A1
    SPKI SHA256: 026F0A8E207F05F1F172DB713DC22D0F43C8FF0D69724AA6FAC6A8393DF62508
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CA for AATL - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE49C27F39EA139228D9BC52EF28
- SHA-256: 2E8820DC0EAFAE3D6D285C057ECE14470B377438B002CEDD4C72B4F343A54F43
- SPKI SHA-256: 36C26F984C33BE48C521B4BD0105247714F7A5942E9FA4BAFDB2F154EB7080F6
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsaatlsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.31, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:49:c2:7f:39:ea:13:92:28:d9:bc:52:ef:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                60:FE:AE:A7:CF:D3:1B:44:B1:12:2A:E6:6C:58:86:1D:11:AB:B2:3B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.31
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E8820DC0EAFAE3D6D285C057ECE14470B377438B002CEDD4C72B4F343A54F43
    SPKI SHA256: 36C26F984C33BE48C521B4BD0105247714F7A5942E9FA4BAFDB2F154EB7080F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.31, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign CA for AATL - SHA384 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D8A4A62D2B28113982A94D
- SHA-256: AC0AB963BB5F3DA05FBC8687F98C2B6EA0BB499E6118C1A9136B1BC7C3C71A6B
- SPKI SHA-256: 797C92CC2B0158321F986174D5CC0326074076DF078FB0F8DBDAA02F668DFB35
- Validity: 2018-04-18 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:a6:2d:2b:28:11:39:82:a9:4d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AC0AB963BB5F3DA05FBC8687F98C2B6EA0BB499E6118C1A9136B1BC7C3C71A6B
    SPKI SHA256: 797C92CC2B0158321F986174D5CC0326074076DF078FB0F8DBDAA02F668DFB35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign CA for AATL on HV

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL on HV
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01F240411672B1BCA5A37FE50A
- SHA-256: 1C9266902A31C3941B506D44D0D4D06EC9DB7655E65F9557659FAB768B290B1B
- SPKI SHA-256: 6FF87E7C00DE7FA23F2AC1EC0AA7391F3D89304397D654AB6F4298813C537985
- Validity: 2019-01-16 to 2024-01-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:41:16:72:b1:bc:a5:a3:7f:e5:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jan 16 00:00:00 2019 GMT
            Not After : Jan 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL on HV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3A:F3:D5:9D:10:22:E4:7D:26:92:BF:A0:35:03:8C:87:AC:85:2A:B7
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1C9266902A31C3941B506D44D0D4D06EC9DB7655E65F9557659FAB768B290B1B
    SPKI SHA256: 6FF87E7C00DE7FA23F2AC1EC0AA7391F3D89304397D654AB6F4298813C537985
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign CA for AATL on HV

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL on HV
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E123522E1808CF312623B0A8
- SHA-256: BCBD04D4AED962C9D25AFE0CFAF8638CE1431652988EC5217329E7559AC3C671
- SPKI SHA-256: 6FF87E7C00DE7FA23F2AC1EC0AA7391F3D89304397D654AB6F4298813C537985
- Validity: 2017-04-19 to 2022-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e1:23:52:2e:18:08:cf:31:26:23:b0:a8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Apr 19 00:00:00 2017 GMT
            Not After : Apr 19 00:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL on HV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3A:F3:D5:9D:10:22:E4:7D:26:92:BF:A0:35:03:8C:87:AC:85:2A:B7
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BCBD04D4AED962C9D25AFE0CFAF8638CE1431652988EC5217329E7559AC3C671
    SPKI SHA256: 6FF87E7C00DE7FA23F2AC1EC0AA7391F3D89304397D654AB6F4298813C537985
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Client Authentication Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803183F095CF4B7F77C8966AC482AE5
- SHA-256: F375270F2F216B9F62CC31795619F6FE1943DF65D1B198D3341170A40725BFC7
- SPKI SHA-256: FAFA6F52E667AE7D3E17407F49F585CA705CD5597F5850CFFDFA64DA6BB3D0CB
- Validity: 2020-07-28 to 2037-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/clientauthroote45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:3f:09:5c:f4:b7:f7:7c:89:66:ac:48:2a:e5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2037 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F375270F2F216B9F62CC31795619F6FE1943DF65D1B198D3341170A40725BFC7
    SPKI SHA256: FAFA6F52E667AE7D3E17407F49F585CA705CD5597F5850CFFDFA64DA6BB3D0CB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Client Authentication Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803183FC81EFCD5789A34604978ED52
- SHA-256: 3DA135562E942799D547CA72EA57D7AC03791B24D4E24BA2E1E1331E8A1678F0
- SPKI SHA-256: D389519E335DCCE065FC613B4D1F8839DFFC0A9B7F4299C4C2997C4EEAD32F92
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/clientauthrootr45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:3f:c8:1e:fc:d5:78:9a:34:60:49:78:ed:52
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3DA135562E942799D547CA72EA57D7AC03791B24D4E24BA2E1E1331E8A1678F0
    SPKI SHA256: D389519E335DCCE065FC613B4D1F8839DFFC0A9B7F4299C4C2997C4EEAD32F92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CloudSSL CA - SHA1 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 46F08CDAB0F08159593BB336D8DC
- SHA-256: 663E8A2747368820385C98608DC38480B2BAE7A830573D7DC5435E47095BC1EA
- SPKI SHA-256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
- Validity: 2015-08-19 to 2017-08-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:f0:8c:da:b0:f0:81:59:59:3b:b3:36:d8:dc
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Aug 19 00:00:00 2015 GMT
            Not After : Aug 19 00:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA1 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:16:FC:68:8A:DF:10:13:A7:35:09:6F:27:7C:3A:4F:8D:D5:4D:71
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 663E8A2747368820385C98608DC38480B2BAE7A830573D7DC5435E47095BC1EA
    SPKI SHA256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA1 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 46C74E0BB6DB57F7C6B828DC6A66
- SHA-256: F80CB5207BAC914E56634E0A88119949C46F999CE327CEA3ACB43C5B365C04E9
- SPKI SHA-256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
- Validity: 2015-07-09 to 2017-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:c7:4e:0b:b6:db:57:f7:c6:b8:28:dc:6a:66
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jul  9 00:00:00 2015 GMT
            Not After : Jul  9 00:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA1 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:16:FC:68:8A:DF:10:13:A7:35:09:6F:27:7C:3A:4F:8D:D5:4D:71
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20

                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F80CB5207BAC914E56634E0A88119949C46F999CE327CEA3ACB43C5B365C04E9
    SPKI SHA256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA1 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA1 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 4674374A168420CB62A61364E5E6
- SHA-256: D68344E566E081B06BA35668D792A100FD20A7DF764A2E66411D165571B67605
- SPKI SHA-256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
- Validity: 2015-04-30 to 2017-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:4a:16:84:20:cb:62:a6:13:64:e5:e6
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA1 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:16:FC:68:8A:DF:10:13:A7:35:09:6F:27:7C:3A:4F:8D:D5:4D:71
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20

                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D68344E566E081B06BA35668D792A100FD20A7DF764A2E66411D165571B67605
    SPKI SHA256: F540A516DF5C784BEBF7FCA9E7884F61EDF97EE159094C8128EA6733255D5317
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 4674377359B7A74A8BD85094C5CB
- SHA-256: C2E4236DB1B757B51B77921388EFA823E6A600FD4BDA30B63AB77886F25618B7
- SPKI SHA-256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
- Validity: 2015-04-30 to 2025-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cloudsslsha2g3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:73:59:b7:a7:4a:8b:d8:50:94:c5:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:2B:87:E1:CE:24:47:3B:1B:BF:CF:85:37:02:55:9D:0D:94:58:E6
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20

                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C2E4236DB1B757B51B77921388EFA823E6A600FD4BDA30B63AB77886F25618B7
    SPKI SHA256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48CA817AC6DC7F56B680BB433625
- SHA-256: E0C2EBD1F6BAD4FEAAE31A3107E69ABEE902DB38B9DFBE33F0570BDA3494C20A
- SPKI SHA-256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
- Validity: 2016-10-14 to 2025-08-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cloudsslsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:ca:81:7a:c6:dc:7f:56:b6:80:bb:43:36:25
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 14 00:00:00 2016 GMT
            Not After : Aug 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:2B:87:E1:CE:24:47:3B:1B:BF:CF:85:37:02:55:9D:0D:94:58:E6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E0C2EBD1F6BAD4FEAAE31A3107E69ABEE902DB38B9DFBE33F0570BDA3494C20A
    SPKI SHA256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 46F08CDBCF2C5466EF3301DD5F34
- SHA-256: 4B7334E1D8999822BAFA8FF6888125389B18A4E5AB26FFA624C7F68FDC81F0CB
- SPKI SHA-256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
- Validity: 2015-08-19 to 2025-08-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cloudsslsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:f0:8c:db:cf:2c:54:66:ef:33:01:dd:5f:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Aug 19 00:00:00 2015 GMT
            Not After : Aug 19 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:2B:87:E1:CE:24:47:3B:1B:BF:CF:85:37:02:55:9D:0D:94:58:E6
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4B7334E1D8999822BAFA8FF6888125389B18A4E5AB26FFA624C7F68FDC81F0CB
    SPKI SHA256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CloudSSL CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CloudSSL CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 46C74E0C48772142E37AD751152F
- SHA-256: E155EBF96334E79AE2E287D55CFC9185DE24935A653F13C5BA05AFF818771BC6
- SPKI SHA-256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
- Validity: 2015-07-09 to 2025-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cloudsslsha2g3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:c7:4e:0c:48:77:21:42:e3:7a:d7:51:15:2f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jul  9 00:00:00 2015 GMT
            Not After : Jul  9 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CloudSSL CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:2B:87:E1:CE:24:47:3B:1B:BF:CF:85:37:02:55:9D:0D:94:58:E6
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20

                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E155EBF96334E79AE2E287D55CFC9185DE24935A653F13C5BA05AFF818771BC6
    SPKI SHA256: F95649C4782B38E895C94C603116DFA28F86216ACC29DE1A7A5941047B4170A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Code Signing Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root E45
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031841D670175856D679210AFB94C3
- SHA-256: E506B72BB97A14D24959A0D1A977E1ACDB6155D68FB4846885E544D147E7D577
- SPKI SHA-256: BFD7325B0D1AA2D54F9E4BE938C72203E4BD73904341B0C1836361C2632122E1
- Validity: 2020-07-28 to 2037-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/codesigningroote45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:41:d6:70:17:58:56:d6:79:21:0a:fb:94:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2037 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A7:9F:DD:D3:54:CD:DB:F8:6C:BF:26:6C:0E:E4:D7:5B:6F:80:CC:42
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E506B72BB97A14D24959A0D1A977E1ACDB6155D68FB4846885E544D147E7D577
    SPKI SHA256: BFD7325B0D1AA2D54F9E4BE938C72203E4BD73904341B0C1836361C2632122E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Code Signing Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803184245708A41CF6F01B8EEB4A954
- SHA-256: 05E0634B1FEB98AE6B4CF101728CF9D5A1793CEACE301506FF332B22D4CF08EB
- SPKI SHA-256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/codesigningrootr45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 05E0634B1FEB98AE6B4CF101728CF9D5A1793CEACE301506FF332B22D4CF08EB
    SPKI SHA256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Code Signing Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AA9281D596F9CD0CEB0FEA97A649B
- SHA-256: 6385DDCD1B768648267EE5122897CA085FC45D6030ECB55098F583AF152AA4A6
- SPKI SHA-256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
- Validity: 2020-09-16 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/codesigningrootr45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:28:1d:59:6f:9c:d0:ce:b0:fe:a9:7a:64:9b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6385DDCD1B768648267EE5122897CA085FC45D6030ECB55098F583AF152AA4A6
    SPKI SHA256: 40421166D1EEAE9674D5A6ABB0D5E6A16AA9764FEB7131A152106356B4E5CA9F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign CodeSigning CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 751E3EE9C5DC2F3E8F04E59DEE5ED409
- SHA-256: FFFE077503FD72F0E5338B0A7B4E218E7D1FF82E493E7E852AE51AA1C7585D17
- SPKI SHA-256: 6C04E803541D6BB33B5EC03BDAF477BCAD9DC3157712D88F7827F0B309C3878E
- Validity: 2011-04-13 to 2026-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gscodesigng2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3e:e9:c5:dc:2f:3e:8f:04:e5:9d:ee:5e:d4:09
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CodeSigning CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:6E:D8:B6:9C:8A:BF:ED:3E:D7:C3:74:5D:CC:80:1F:A8:2F:50:7A
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FFFE077503FD72F0E5338B0A7B4E218E7D1FF82E493E7E852AE51AA1C7585D17
    SPKI SHA256: 6C04E803541D6BB33B5EC03BDAF477BCAD9DC3157712D88F7827F0B309C3878E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CodeSigning CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 47C30FFEFC22BB280F96FEA75251
- SHA-256: 4047C9D69260C07213BCB8608A7EC5E2838A56B79F67847812EAC0778D0D27F1
- SPKI SHA-256: FB724ED65485A6B0E469B9B5FF04835B7F0126D0B25392BB31EAEAD3FFF49823
- Validity: 2016-03-16 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gscodesigng3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 16 00:00:00 2016 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CodeSigning CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B3:D3:E6:D5:71:56:7D:39:58:B3:78:D2:2B:B8:F7:A1:1F:FD:4B:9B
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4047C9D69260C07213BCB8608A7EC5E2838A56B79F67847812EAC0778D0D27F1
    SPKI SHA256: FB724ED65485A6B0E469B9B5FF04835B7F0126D0B25392BB31EAEAD3FFF49823
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign CodeSigning CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3F7943C5A04C67CB7B4D63965848
- SHA-256: BE40813869AB27A071D12AD6A8830583EBC3B618E3F2346359F4B11A1C9434EE
- SPKI SHA-256: 600232760181F8BDD8D0D1CD9AC0062D00D77A8EF0C3C4CBBE95C628530F277B
- Validity: 2011-08-02 to 2028-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gscodesignsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:79:43:c5:a0:4c:67:cb:7b:4d:63:96:58:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CodeSigning CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                19:4A:B8:5A:E4:4D:31:A5:14:E5:5E:EC:2F:A3:1C:FA:80:8C:32:6B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BE40813869AB27A071D12AD6A8830583EBC3B618E3F2346359F4B11A1C9434EE
    SPKI SHA256: 600232760181F8BDD8D0D1CD9AC0062D00D77A8EF0C3C4CBBE95C628530F277B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign CodeSigning CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CodeSigning CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 481B6A0726D2E83F2602D4825ACD
- SHA-256: FB54EEA9BCE8E9EA9782154F3D414277FB709F49B947D73978AC278546C2CE03
- SPKI SHA-256: 5F67B9340C277BEFCB4BE2C4E48A0631018A2A7BDE10F8F20A645C3899491D58
- Validity: 2016-06-15 to 2024-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gscodesignsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CodeSigning CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:3A:E7:AC:94:91:74:2D:96:02:73:83:AD:9C:2E:49:3F:19:AA:54
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FB54EEA9BCE8E9EA9782154F3D414277FB709F49B947D73978AC278546C2CE03
    SPKI SHA256: 5F67B9340C277BEFCB4BE2C4E48A0631018A2A7BDE10F8F20A645C3899491D58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Corporate IT Atlas R45 SMIME CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC3758697D2585C9DDAF1B9C1E4C6B
- SHA-256: 1E95983E605565A3647135FFF16E28070E037CDB8AF714D06C9CFBD0BB285D35
- SPKI SHA-256: F55D1B8BCFEFF837C690E9E9A62907E3E932930D2E648F990F418253BF3D3F18
- Validity: 2023-06-28 to 2027-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gscorpitatlasr45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:58:69:7d:25:85:c9:dd:af:1b:9c:1e:4c:6b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:28 2023 GMT
            Not After : Jan 20 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Corporate IT Atlas R45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                62:7D:B9:66:E3:D5:B5:97:32:96:31:43:72:86:8C:43:D2:78:9E:F6
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1E95983E605565A3647135FFF16E28070E037CDB8AF714D06C9CFBD0BB285D35
    SPKI SHA256: F55D1B8BCFEFF837C690E9E9A62907E3E932930D2E648F990F418253BF3D3F18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Corporate IT Atlas R45 SMIME CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 79299A7B1BD2DDFD10A677C72F5254F5
- SHA-256: 7C4E78C74B4818D17EF8B8AB91E32DB4F7E3CE84A0C5E47AAA62AE39FAB60D01
- SPKI SHA-256: F55D1B8BCFEFF837C690E9E9A62907E3E932930D2E648F990F418253BF3D3F18
- Validity: 2020-01-20 to 2027-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gscorpitatlasr45smimeca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9a:7b:1b:d2:dd:fd:10:a6:77:c7:2f:52:54:f5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jan 20 00:00:00 2020 GMT
            Not After : Jan 20 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Corporate IT Atlas R45 SMIME CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                62:7D:B9:66:E3:D5:B5:97:32:96:31:43:72:86:8C:43:D2:78:9E:F6
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7C4E78C74B4818D17EF8B8AB91E32DB4F7E3CE84A0C5E47AAA62AE39FAB60D01
    SPKI SHA256: F55D1B8BCFEFF837C690E9E9A62907E3E932930D2E648F990F418253BF3D3F18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign Corporate IT Atlas R45 SMIME CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Corporate IT Atlas R45 SMIME CA 2024
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 811403F45B15FC8810B6CA1640BAB15A
- SHA-256: B8829605DD58C892A1D223FCF70D3F8534576E6AC617FA130876AD8B061AB3C1
- SPKI SHA-256: 7AE933F746B843C3140FD0C78A33F1500E3D2F77281C916E6220B94277EA19C2
- Validity: 2024-05-15 to 2031-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gscorpitatlasr45smimeca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:03:f4:5b:15:fc:88:10:b6:ca:16:40:ba:b1:5a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: May 15 03:22:56 2024 GMT
            Not After : May 15 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Corporate IT Atlas R45 SMIME CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                12:54:DA:AF:8A:96:8E:6F:3B:D9:6A:8E:39:EC:BB:F2:F3:2E:FF:E3
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B8829605DD58C892A1D223FCF70D3F8534576E6AC617FA130876AD8B061AB3C1
    SPKI SHA256: 7AE933F746B843C3140FD0C78A33F1500E3D2F77281C916E6220B94277EA19C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign DocumentSign CA

- Subject: countryName=BE, organizationalUnitName=DocumentSign, organizationName=GlobalSign nv-sa, commonName=GlobalSign DocumentSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012019C18D68
- SHA-256: 3F34B4DDA74B42704656230BA80F92148EEB84803E86593BEBE00D074B82BC2B
- SPKI SHA-256: 3364D1F24A51BEB845520F335122A9F50BE8693C912507CFB88A4CF9E15A17BB
- Validity: 2009-03-18 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:20:19:c1:8d:68
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 18 11:00:00 2009 GMT
            Not After : Jan 27 11:00:00 2017 GMT
        Subject: C = BE, OU = DocumentSign, O = GlobalSign nv-sa, CN = GlobalSign DocumentSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B8:D3:13:2B:66:6B:31:01:C5:93:46:83:D9:5D:B7:07:89:F1:DC:1A
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA, S/MIME CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3F34B4DDA74B42704656230BA80F92148EEB84803E86593BEBE00D074B82BC2B
    SPKI SHA256: 3364D1F24A51BEB845520F335122A9F50BE8693C912507CFB88A4CF9E15A17BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign DocumentSign CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign DocumentSign CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C646EC
- SHA-256: C181D444A99E02611BDA284BAD8DE4AEB88C6D0DD295420C36D4C1D0F506612C
- SPKI SHA-256: 361BAE6F5B3D91C5ED1E183651D43CE84295A3139F3C1AA975AE1CC8C0F3D171
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:46:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign DocumentSign CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:C2:E2:46:09:CC:DF:A6:54:DA:AB:8D:92:47:87:A8:97:48:57:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C181D444A99E02611BDA284BAD8DE4AEB88C6D0DD295420C36D4C1D0F506612C
    SPKI SHA256: 361BAE6F5B3D91C5ED1E183651D43CE84295A3139F3C1AA975AE1CC8C0F3D171
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA

- Subject: countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5F895
- SHA-256: 8FEE239321E07539FDF7B0B73F997A7ACA22A74F1299F25B99DD3D7ECFD3D15E
- SPKI SHA-256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
- Validity: 2007-05-04 to 2017-05-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:f8:95
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: May  4 10:00:00 2007 GMT
            Not After : May  4 12:00:00 2017 GMT
        Subject: C = BE, OU = Domain Validation CA, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                36:12:4E:9E:71:C4:26:41:F1:FA:F1:29:4C:BF:17:A4:53:28:B6:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8FEE239321E07539FDF7B0B73F997A7ACA22A74F1299F25B99DD3D7ECFD3D15E
    SPKI SHA256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Domain Validation CA

- Subject: countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 04000000000127FBF769FE
- SHA-256: 65E0DB51904D0EB88E278D0AF0557F9FBC568CBF8460544F0E193152EBD03755
- SPKI SHA-256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
- Validity: 2007-05-04 to 2017-05-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:f7:69:fe
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: May  4 10:00:00 2007 GMT
            Not After : May  4 11:00:00 2017 GMT
        Subject: C = BE, OU = Domain Validation CA, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                36:12:4E:9E:71:C4:26:41:F1:FA:F1:29:4C:BF:17:A4:53:28:B6:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 65E0DB51904D0EB88E278D0AF0557F9FBC568CBF8460544F0E193152EBD03755
    SPKI SHA256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Domain Validation CA

- Subject: countryName=BE, organizationalUnitName=Domain Validation CA, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5FA2C
- SHA-256: 0A989265B959373CD2F69713B0D51868E288AB68FFCF2C94913AB8A47FD8298D
- SPKI SHA-256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
- Validity: 2007-05-04 to 2017-05-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:fa:2c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: May  4 10:00:00 2007 GMT
            Not After : May  4 12:00:00 2017 GMT
        Subject: C = BE, OU = Domain Validation CA, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                36:12:4E:9E:71:C4:26:41:F1:FA:F1:29:4C:BF:17:A4:53:28:B6:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0A989265B959373CD2F69713B0D51868E288AB68FFCF2C94913AB8A47FD8298D
    SPKI SHA256: AD439F8B723888088669A660B15036481DB69BCE96CDB2343DCDEC7EC513B688
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Domain Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE14143
- SHA-256: E87EA2BED6C6203B2C55B00FE49D2876FBA64702105AEB748B865A918B5C7D27
- SPKI SHA-256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:41:43
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:AD:FA:B0:5B:B9:83:64:2A:76:C2:1C:8A:69:DA:42:DC:FE:FD:28
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E87EA2BED6C6203B2C55B00FE49D2876FBA64702105AEB748B865A918B5C7D27
    SPKI SHA256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000013189E55925
- SHA-256: BA0E2B6BF2C98ED2C3B1C1C08A1BBDCAF9270AC528A3194301DD2A0B6B67B9B3
- SPKI SHA-256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:e5:59:25
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:AD:FA:B0:5B:B9:83:64:2A:76:C2:1C:8A:69:DA:42:DC:FE:FD:28
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BA0E2B6BF2C98ED2C3B1C1C08A1BBDCAF9270AC528A3194301DD2A0B6B67B9B3
    SPKI SHA256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Domain Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13F11
- SHA-256: 4E153A588877688F1A0C103A084C2EDB3AD1D8C480CF03D8AB6FED47D9204370
- SPKI SHA-256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:3f:11
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:AD:FA:B0:5B:B9:83:64:2A:76:C2:1C:8A:69:DA:42:DC:FE:FD:28
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4E153A588877688F1A0C103A084C2EDB3AD1D8C480CF03D8AB6FED47D9204370
    SPKI SHA256: 4C46FD49DC95E5AFCA8CCECF0A6E1D3A38BEF767A4C72EEEB812B22351A0E6FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48CA8155594FB7B3665EA1D25265
- SHA-256: 37D080A5E9A526663E56EE20DE4BD9F7952DACC341491439080167AD5DD18CAC
- SPKI SHA-256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
- Validity: 2016-10-14 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsdomainvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:ca:81:55:59:4f:b7:b3:66:5e:a1:d2:52:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 14 00:00:00 2016 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:4E:7C:D4:80:2D:E5:15:81:86:26:8C:82:6D:C0:98:A4:CF:97:0F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 37D080A5E9A526663E56EE20DE4BD9F7952DACC341491439080167AD5DD18CAC
    SPKI SHA256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001444EF03E20
- SHA-256: BFDF4CF3F143AD0DB912D8AB3A7C12F617B9EA60CE8B1F4E44F74270FB21B19B
- SPKI SHA-256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
- Validity: 2014-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsdomainvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:3e:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:4E:7C:D4:80:2D:E5:15:81:86:26:8C:82:6D:C0:98:A4:CF:97:0F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BFDF4CF3F143AD0DB912D8AB3A7C12F617B9EA60CE8B1F4E44F74270FB21B19B
    SPKI SHA256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C64258
- SHA-256: 669E7727A92BE72D9718E16922DC1BC1492B1AF33FA4793E68D8778F19A2EBE0
- SPKI SHA-256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsdomainvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:42:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:4E:7C:D4:80:2D:E5:15:81:86:26:8C:82:6D:C0:98:A4:CF:97:0F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 669E7727A92BE72D9718E16922DC1BC1492B1AF33FA4793E68D8778F19A2EBE0
    SPKI SHA256: 3CBD7F4D30C47BD0A6DA56F65F4B62C72402EF368F4449BF57420726C7130A6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Domain Validation CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Domain Validation CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 4707B100F41822434EC05B8C7B7F
- SHA-256: 09BC1B137C031239EF788673E94EB17F5F3ECAB07D3ADBFB485E75ABFAAF3B9A
- SPKI SHA-256: D647E5B3121E0756DCC56D42EB5C8535D3508CEFF1B85D0E45D2FD12D31EF91B
- Validity: 2015-09-04 to 2025-09-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsdomainvalsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:07:b1:00:f4:18:22:43:4e:c0:5b:8c:7b:7f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep  4 00:00:00 2015 GMT
            Not After : Sep  4 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3D:80:82:79:C5:48:82:A3:C3:12:EE:DF:99:0F:57:35:48:9E:D0:CB
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 09BC1B137C031239EF788673E94EB17F5F3ECAB07D3ADBFB485E75ABFAAF3B9A
    SPKI SHA256: D647E5B3121E0756DCC56D42EB5C8535D3508CEFF1B85D0E45D2FD12D31EF91B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign E45 AATL Root CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Root CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 7803187B7CE1A1E8689899D2C0AA1A09
- SHA-256: 87903E20623512D28BDBFACE4D41BD50F5BA6B1B2E8CCAB134CE161769EAEC00
- SPKI SHA-256: B616C3F9F6370138994C695235F117E57ACC8A8A134DA0D472480A11550BF7B3
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gse45aatlrootca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:7b:7c:e1:a1:e8:68:98:99:d2:c0:aa:1a:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E45 AATL Root CA 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6D:CF:6B:22:48:1C:08:57:3E:F7:F5:11:81:FB:26:75:9C:54:AB:47
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 87903E20623512D28BDBFACE4D41BD50F5BA6B1B2E8CCAB134CE161769EAEC00
    SPKI SHA256: B616C3F9F6370138994C695235F117E57ACC8A8A134DA0D472480A11550BF7B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign E45 AATL Trusted CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Trusted CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 86154A26AEE5E9465B8918904CC5A127
- SHA-256: 7368C1EECB8E7ACCE64D5334C275018761F00390F538DBAA3D48AC18CB2BDA33
- SPKI SHA-256: 54463AE51860A78E82FFE3C0F0CBEA1296EB79F98AD00465D945888D21F1F54E
- Validity: 2026-06-24 to 2041-06-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:15:4a:26:ae:e5:e9:46:5b:89:18:90:4c:c5:a1:27
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Jun 24 03:15:36 2026 GMT
            Not After : Jun 23 12:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E45 AATL Trusted CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                17:D3:53:36:D2:E9:5A:8F:C3:1B:37:70:EA:58:61:DA:38:7B:22:64
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7368C1EECB8E7ACCE64D5334C275018761F00390F538DBAA3D48AC18CB2BDA33
    SPKI SHA256: 54463AE51860A78E82FFE3C0F0CBEA1296EB79F98AD00465D945888D21F1F54E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign E46 AATL TimeStamping Root CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E46 AATL TimeStamping Root CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Serial: 79B9FF760B3C13FCE07081B81FADA81B
- SHA-256: 2A34A0225DBC82845E8C5F2F13897179A9B2D91E74D93BDE0021F4F89804E59F
- SPKI SHA-256: 5101042DC4DBC2DB67B6860D472C9D21FFF7B42E4C519BF6BF5C5176B34ABCC5
- Validity: 2021-05-19 to 2038-05-18
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gse46aatltimestampingrootca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- CRL DP: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:76:0b:3c:13:fc:e0:70:81:b8:1f:ad:a8:1b
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 18 23:59:59 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E46 AATL TimeStamping Root CA 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                95:3A:CB:7F:99:86:2B:A5:74:6B:49:DE:B0:B5:09:84:26:3F:59:D5
            X509v3 Authority Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamproote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamproote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamproote46.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.31
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 2A34A0225DBC82845E8C5F2F13897179A9B2D91E74D93BDE0021F4F89804E59F
    SPKI SHA256: 5101042DC4DBC2DB67B6860D472C9D21FFF7B42E4C519BF6BF5C5176B34ABCC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamproote46.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign E46 AATL TimeStamping Trusted CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E46 AATL TimeStamping Trusted CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Serial: 86154A48828DEF574555AE73EF0C1ABB
- SHA-256: F203815710C645FE3E26FC337D5027DC527072A31B527F2E4AE725D2786C27E1
- SPKI SHA-256: B6D2D94EB8C3D27F0BCEFDD90FFF476C2F181417E835BF85878CB8BC002A253D
- Validity: 2026-06-24 to 2044-06-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- CRL DP: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:15:4a:48:82:8d:ef:57:45:55:ae:73:ef:0c:1a:bb
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Validity
            Not Before: Jun 24 03:16:03 2026 GMT
            Not After : Jun 23 12:00:00 2044 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E46 AATL TimeStamping Trusted CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DC:C9:CA:46:38:5C:6E:DE:82:B2:A5:62:AC:57:FB:2F:8B:8A:52:14
            X509v3 Authority Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamproote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamproote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamproote46.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.31
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F203815710C645FE3E26FC337D5027DC527072A31B527F2E4AE725D2786C27E1
    SPKI SHA256: B6D2D94EB8C3D27F0BCEFDD90FFF476C2F181417E835BF85878CB8BC002A253D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- AIA OCSP: http://ocsp.globalsign.com/timestamproote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamproote46.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamproote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign EC Administration CA2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign EC Administration CA2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 24F0DBB59C08A32167D7664D626A5FE314
- SHA-256: C883B3ECC6AC0DEE75CDD585E73A209287BC0C9F9D79D488860F63E2EA8A7D2C
- SPKI SHA-256: CF36C38877CC9164F42F92AA6A4EEBD826E62CD22DA0E84C66B45D4F57387874
- Validity: 2012-11-13 to 2023-11-13
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/gs/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:f0:db:b5:9c:08:a3:21:67:d7:66:4d:62:6a:5f:e3:14
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Nov 13 00:00:00 2023 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign EC Administration CA2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/root-r5.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 Subject Key Identifier:
                9A:1B:67:20:BE:8F:F7:46:0E:30:F6:9A:7C:DF:61:8E:4C:A6:BA:5C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C883B3ECC6AC0DEE75CDD585E73A209287BC0C9F9D79D488860F63E2EA8A7D2C
    SPKI SHA256: CF36C38877CC9164F42F92AA6A4EEBD826E62CD22DA0E84C66B45D4F57387874
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/gs/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign ECC CloudSSL CA - SHA384 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC CloudSSL CA - SHA384 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E272B85D880570D4FDBDC343
- SHA-256: B0CD6AE7B9E20EC5F830FEE01F666D5D90E6E229D06BC46A30ACCEDFEC889648
- SPKI SHA-256: 8EF924650096FA6854BE0FA2D864E7F84DC568E6285612757824BEA3A438C8D9
- Validity: 2017-06-21 to 2027-06-21
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/cloudssleccsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e2:72:b8:5d:88:05:70:d4:fd:bd:c3:43
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 21 00:00:00 2017 GMT
            Not After : Jun 21 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC CloudSSL CA - SHA384 - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:32:2A:83:8A:CB:60:F8:BB:1B:46:A9:28:27:97:32:0F:FC:DD:5F
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B0CD6AE7B9E20EC5F830FEE01F666D5D90E6E229D06BC46A30ACCEDFEC889648
    SPKI SHA256: 8EF924650096FA6854BE0FA2D864E7F84DC568E6285612757824BEA3A438C8D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- expires_within_398_days

### GlobalSign ECC EV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC EV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F22A52F7D6C161AED4BB2
- SHA-256: 8F19FFE02FC795ED70765D1436ADDF772FE0F0773DA436EDBDB42A2E30E2E828
- SPKI SHA-256: 383FD60DB0F756C7CCC30373CF2F4C59DF495E9A4A07BED56F7493DB09FD99E8
- Validity: 2018-11-21 to 2028-11-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gseccevsslca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:a5:2f:7d:6c:16:1a:ed:4b:b2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC EV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:EF:DD:FC:97:42:D7:55:28:0D:E2:F7:30:78:74:EF:52:8B:6D:DD
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8F19FFE02FC795ED70765D1436ADDF772FE0F0773DA436EDBDB42A2E30E2E828
    SPKI SHA256: 383FD60DB0F756C7CCC30373CF2F4C59DF495E9A4A07BED56F7493DB09FD99E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign ECC EV SSL CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC EV SSL CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 11D71C248687906A7F8564BC7810FD4B5FC3
- SHA-256: 0D3176C58F321AA34C57C8DF7C17D1F4E76C797EC116C9F1D697748ED1FCE7D9
- SPKI SHA-256: 3A46AF11707512E7F8CA76C916F8090464A0362728EA078F32783312999B30F2
- Validity: 2019-04-10 to 2029-04-10
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d7:1c:24:86:87:90:6a:7f:85:64:bc:78:10:fd:4b:5f:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Apr 10 00:00:00 2019 GMT
            Not After : Apr 10 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC EV SSL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F9:EC:81:C9:90:A3:04:3C:7C:A4:EC:45:C9:56:A8:E2:CA:DF:C9:64
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0D3176C58F321AA34C57C8DF7C17D1F4E76C797EC116C9F1D697748ED1FCE7D9
    SPKI SHA256: 3A46AF11707512E7F8CA76C916F8090464A0362728EA078F32783312999B30F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign ECC HV S/MIME CA 1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC HV S/MIME CA 1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E528B2BA76EB4593D5A83005
- SHA-256: E0CE5C4EF5D2186963D2B04ADE4612BBAF787E16048A5B468F7367776C3A03DE
- SPKI SHA-256: A40477D157189FE9D8EDB1B03D3FB8AA11E08266BB41676CA7540F2FCC7F60C9
- Validity: 2017-08-23 to 2027-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsecchvsmimeca1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b2:ba:76:eb:45:93:d5:a8:30:05
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 23 00:00:00 2017 GMT
            Not After : Aug 23 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC HV S/MIME CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                70:50:75:F9:15:2E:45:6C:68:AE:F1:52:5B:C8:BE:9C:70:9B:E5:39
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.10
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E0CE5C4EF5D2186963D2B04ADE4612BBAF787E16048A5B468F7367776C3A03DE
    SPKI SHA256: A40477D157189FE9D8EDB1B03D3FB8AA11E08266BB41676CA7540F2FCC7F60C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.10
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### GlobalSign ECC OV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC OV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F2295424905F90191A8DC
- SHA-256: 87C71553445EB3C33C3E0710711B99E9C7773F04D91AC38A9F4C082EE24101EA
- SPKI SHA-256: 289A5E7685C6F9177A2099D878E263C548E568310323C2B5BC2041833789902E
- Validity: 2018-11-21 to 2028-11-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gseccovsslca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:95:42:49:05:f9:01:91:a8:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC OV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                58:7B:8E:75:2A:FE:61:80:AA:90:40:01:AE:D6:E8:07:46:6E:3F:48
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 87C71553445EB3C33C3E0710711B99E9C7773F04D91AC38A9F4C082EE24101EA
    SPKI SHA256: 289A5E7685C6F9177A2099D878E263C548E568310323C2B5BC2041833789902E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign ECC384 EV SSL CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC384 EV SSL CA - G3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 4674377816261D0E7ADBE2CCB5FC
- SHA-256: 15549187490314F5177641F0BEB32634AA1230EB2CF2C28AD9C73914FB18ABA0
- SPKI SHA-256: 323C089815C63C29464A6749A42962C269CB1B8AE48B0F2BF2A873D381011D97
- Validity: 2015-04-30 to 2025-04-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:78:16:26:1d:0e:7a:db:e2:cc:b5:fc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC384 EV SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:78:F5:CE:5C:1A:87:BF:AF:F1:54:EC:F0:AB:6E:A8:DF:2E:B1:EA
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 15549187490314F5177641F0BEB32634AA1230EB2CF2C28AD9C73914FB18ABA0
    SPKI SHA256: 323C089815C63C29464A6749A42962C269CB1B8AE48B0F2BF2A873D381011D97
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign ECC384 SSL CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC384 SSL CA - G3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 46743777920973FA482FE28D9462
- SHA-256: DC6C44AC8A3CD5C3451273F4431526B2EF666062EE763258A928F60BD08E39FE
- SPKI SHA-256: 2E1174874898268932B941D99D1C5F5D3ED84985B7A80D667A83C49894CD21F5
- Validity: 2015-04-30 to 2025-04-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:77:92:09:73:fa:48:2f:e2:8d:94:62
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC384 SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FF:BB:C8:BD:C9:D4:57:F0:0D:FF:50:A6:4A:46:43:AF:13:CE:02:68
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DC6C44AC8A3CD5C3451273F4431526B2EF666062EE763258A928F60BD08E39FE
    SPKI SHA256: 2E1174874898268932B941D99D1C5F5D3ED84985B7A80D667A83C49894CD21F5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C6492E
- SHA-256: 5BB2382D20E09AE56B4F3A5157838F7BAE49E42E3CE53484D66EEB2C0747EF4A
- SPKI SHA-256: 2EF4621848D1A9FCEEADECDA5AE8FC5A27B68321CCAD6E50D3A2ECA4C9E8C7B0
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:49:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:40:77:43:65:1C:F8:FE:A7:E3:F4:64:82:3E:4D:43:13:22:31:02
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5BB2382D20E09AE56B4F3A5157838F7BAE49E42E3CE53484D66EEB2C0747EF4A
    SPKI SHA256: 2EF4621848D1A9FCEEADECDA5AE8FC5A27B68321CCAD6E50D3A2ECA4C9E8C7B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48A402DD27920DA208349DD1997B
- SHA-256: AED5DD9A5339685DFB029F6D89A14335A96512C3CACC52B2994AF8B6B37FA4D2
- SPKI SHA-256: F3A7CB21EB68A502C3371159D2E308EBA5E9975A4580B9471E7F6FEA44F48B82
- Validity: 2016-09-21 to 2026-09-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsextendvalsha2g3r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:a4:02:dd:27:92:0d:a2:08:34:9d:d1:99:7b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 21 00:00:00 2016 GMT
            Not After : Sep 21 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DD:B3:E7:6D:A8:2E:E8:C5:4E:6E:CF:74:E6:75:3C:94:15:CE:E8:1D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AED5DD9A5339685DFB029F6D89A14335A96512C3CACC52B2994AF8B6B37FA4D2
    SPKI SHA256: F3A7CB21EB68A502C3371159D2E308EBA5E9975A4580B9471E7F6FEA44F48B82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### GlobalSign Extended Validation CodeSigning CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3F7B02B681F965BA3AC1822EC759
- SHA-256: 1E864278C20881B671C0C6D2E14B61150AD1F13CF92C6EC14B550DCBC47E1541
- SPKI SHA-256: 1CDAFAA0E11EAC7B736830A67DFFB82DB660143C32465238771E09233B71777B
- Validity: 2011-08-02 to 2028-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsevcodesignsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:7b:02:b6:81:f9:65:ba:3a:c1:82:2e:c7:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CodeSigning CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0A:BC:24:2C:2C:F7:9C:E5:9F:95:7C:AD:BB:D5:F0:18:51:39:85:6E
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.2
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.3
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1E864278C20881B671C0C6D2E14B61150AD1F13CF92C6EC14B550DCBC47E1541
    SPKI SHA256: 1CDAFAA0E11EAC7B736830A67DFFB82DB660143C32465238771E09233B71777B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Extended Validation CodeSigning CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 481B6A07A9424C1EAAFEF3CDF10F
- SHA-256: DD038E87E0B4D2C369680D3DE78638AB39FC1D7E50632996921101768DB8D4D8
- SPKI SHA-256: 640B975E2A29E681FD956CB26A2E1918305E39792D66A59C7153E6D31B7E2A1B
- Validity: 2016-06-15 to 2024-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsextendcodesignsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CodeSigning CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DC:2C:58:2C:2A:6F:35:2D:9F:79:95:A8:48:5D:C4:6D:3E:53:BF:B9
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.2
                Policy: 2.23.140.1.3
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DD038E87E0B4D2C369680D3DE78638AB39FC1D7E50632996921101768DB8D4D8
    SPKI SHA256: 640B975E2A29E681FD956CB26A2E1918305E39792D66A59C7153E6D31B7E2A1B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation SHA256 CA

- Subject: organizationalUnitName=Extended Validation SHA256 CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation SHA256 CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000125071044D5
- SHA-256: 97D0B19E6A8865E0155CA2F59D48EE2858D2D25192D58597017F8BD82B29F5D9
- SPKI SHA-256: 14F292A513108EFD3BA4789719E14C11C27569D0AFCE44C9EEE5D7E5C1CB0E21
- Validity: 2009-11-18 to 2019-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:07:10:44:d5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 18 10:00:00 2009 GMT
            Not After : Mar 18 10:00:00 2019 GMT
        Subject: OU = Extended Validation SHA256 CA, O = GlobalSign, CN = GlobalSign Extended Validation SHA256 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8A:FC:14:1B:3D:A3:59:67:A5:3B:E1:73:92:A6:62:91:7F:E4:78:30
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 97D0B19E6A8865E0155CA2F59D48EE2858D2D25192D58597017F8BD82B29F5D9
    SPKI SHA256: 14F292A513108EFD3BA4789719E14C11C27569D0AFCE44C9EEE5D7E5C1CB0E21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Extended Validation SHA256 CA

- Subject: organizationalUnitName=Extended Validation SHA256 CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation SHA256 CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000125071040DD
- SHA-256: 7C99C3984BD948B13831C45FBBB6DA24506E815693AB6A91B60CB0CE4E410B74
- SPKI SHA-256: 14F292A513108EFD3BA4789719E14C11C27569D0AFCE44C9EEE5D7E5C1CB0E21
- Validity: 2009-11-18 to 2019-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLSHA256CA
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:07:10:40:dd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 18 10:00:00 2009 GMT
            Not After : Mar 18 10:00:00 2019 GMT
        Subject: OU = Extended Validation SHA256 CA, O = GlobalSign, CN = GlobalSign Extended Validation SHA256 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8A:FC:14:1B:3D:A3:59:67:A5:3B:E1:73:92:A6:62:91:7F:E4:78:30
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLSHA256CA
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7C99C3984BD948B13831C45FBBB6DA24506E815693AB6A91B60CB0CE4E410B74
    SPKI SHA256: 14F292A513108EFD3BA4789719E14C11C27569D0AFCE44C9EEE5D7E5C1CB0E21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLSHA256CA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign GCC E45 AATL CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 AATL CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign E45 AATL Trusted CA 2026
- Serial: 8644014F808A322759CA86008E94608B
- SHA-256: 94FF0C096E12F0CE92F862AA29CC675CB7B4F206C97B71CDD082400108606A60
- SPKI SHA-256: EA8EAA3B90EC2263A6F24D5B268E0BA3C9DEB8CD7045D535A3E11A3325860310
- Validity: 2026-07-22 to 2041-06-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gse45aatltrustedca2026
- CRL DP: http://crl.globalsign.com/gse45aatltrustedca2026.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:44:01:4f:80:8a:32:27:59:ca:86:00:8e:94:60:8b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign E45 AATL Trusted CA 2026
        Validity
            Not Before: Jul 22 05:02:22 2026 GMT
            Not After : Jun 23 12:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 AATL CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8A:4F:49:D8:FE:F8:E5:E6:8C:D3:3C:1F:86:5A:AF:51:23:4A:A7:42
            X509v3 Authority Key Identifier:
                17:D3:53:36:D2:E9:5A:8F:C3:1B:37:70:EA:58:61:DA:38:7B:22:64
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gse45aatltrustedca2026
                CA Issuers - URI:http://secure.globalsign.com/cacert/gse45aatltrustedca2026.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gse45aatltrustedca2026.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 94FF0C096E12F0CE92F862AA29CC675CB7B4F206C97B71CDD082400108606A60
    SPKI SHA256: EA8EAA3B90EC2263A6F24D5B268E0BA3C9DEB8CD7045D535A3E11A3325860310
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gse45aatltrustedca2026
- AIA CA Issuers: http://secure.globalsign.com/cacert/gse45aatltrustedca2026.crt
- CRL Distribution Points: http://crl.globalsign.com/gse45aatltrustedca2026.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 Client Authentication CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Client Authentication CA 2023
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 7E2A88ED4FEEDCFFA52AC0B7512A1077
- SHA-256: ED8C173B5AA6C71B4456E10C2D9841D2F8B358E093C24BE021508EB0E79505A6
- SPKI SHA-256: 70BC10084A60947C20AD1AEDBAE1675A797CD2E6E3662C54FAA444974B1DCD45
- Validity: 2023-02-22 to 2033-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:2a:88:ed:4f:ee:dc:ff:a5:2a:c0:b7:51:2a:10:77
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Feb 22 03:16:51 2023 GMT
            Not After : Feb 22 00:00:00 2033 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 Client Authentication CA 2023
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                33:C0:8B:91:4A:B8:7B:ED:39:17:81:C2:36:CE:68:9C:19:90:03:C8
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.2.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ED8C173B5AA6C71B4456E10C2D9841D2F8B358E093C24BE021508EB0E79505A6
    SPKI SHA256: 70BC10084A60947C20AD1AEDBAE1675A797CD2E6E3662C54FAA444974B1DCD45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 Client Authentication CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Client Authentication CA 2024
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 814E426FFDFA550BA02910F9890B7038
- SHA-256: D7F096978E2BE8F431EAC0606EF79A64F4DF1CEC49BEB49DD701F9385DED7C8F
- SPKI SHA-256: AF00A92A4AB3878639B66428B59ECB46E3EBEE29C9FA960CCC49748B4115B692
- Validity: 2024-06-19 to 2034-06-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:42:6f:fd:fa:55:0b:a0:29:10:f9:89:0b:70:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Jun 19 03:26:21 2024 GMT
            Not After : Jun 19 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 Client Authentication CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2A:C6:37:26:C6:A6:43:AB:D1:52:09:7B:AD:49:41:46:3F:DD:23:CB
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D7F096978E2BE8F431EAC0606EF79A64F4DF1CEC49BEB49DD701F9385DED7C8F
    SPKI SHA256: AF00A92A4AB3878639B66428B59ECB46E3EBEE29C9FA960CCC49748B4115B692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 Qualified Authentication CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 780318813B698982393888E2D53E7BD9
- SHA-256: 5F2155F9A7444615C673994CDA99E963BB558A367B20305520E93D15EF3AF4E8
- SPKI SHA-256: 956F29F45689C97AA4FBFDC8B24FE707A1118BB99B3001DB39E6CDDBBA3EE6FA
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45qualauthca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:81:3b:69:89:82:39:38:88:e2:d5:3e:7b:d9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 Qualified Authentication CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CB:3B:7F:7F:58:84:4E:4E:AE:E4:C8:B8:EA:C6:69:0C:56:B0:AF:B8
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5F2155F9A7444615C673994CDA99E963BB558A367B20305520E93D15EF3AF4E8
    SPKI SHA256: 956F29F45689C97AA4FBFDC8B24FE707A1118BB99B3001DB39E6CDDBBA3EE6FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 Qualified QSCD Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 780318874133122B01C7713A4A4D4B11
- SHA-256: 8115E2CB4F04E56EA70EA932D0622831DD53B22BF6A93B3ACD9125FAB0374AF1
- SPKI SHA-256: 66135EDA5FB014CD8A1912AC193E7DD7B4374E4FCBD252E333663F19F2281D79
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45qualqscdsignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:87:41:33:12:2b:01:c7:71:3a:4a:4d:4b:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 Qualified QSCD Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B5:8B:10:BD:AA:8F:6F:BD:E3:48:4E:D8:5F:28:83:17:16:17:3D:3B
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8115E2CB4F04E56EA70EA932D0622831DD53B22BF6A93B3ACD9125FAB0374AF1
    SPKI SHA256: 66135EDA5FB014CD8A1912AC193E7DD7B4374E4FCBD252E333663F19F2281D79
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 Qualified Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E45 Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 7803188E21F68371906A71BF426ED852
- SHA-256: 35E9429CDE680D8D5311CDD46FAEF0AEE694B0556C3D69C4F670E243D64C87FE
- SPKI SHA-256: 62B55815816B4741C8C33BD2E3DD873E08C94B203BA9F9475089CEB293631BEF
- Validity: 2020-07-28 to 2030-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45qualsignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:8e:21:f6:83:71:90:6a:71:bf:42:6e:d8:52
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E45 Qualified Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3E:FA:07:6C:8B:9D:3B:31:81:44:E9:FF:86:DE:A9:0F:2B:95:46:F8
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 35E9429CDE680D8D5311CDD46FAEF0AEE694B0556C3D69C4F670E243D64C87FE
    SPKI SHA256: 62B55815816B4741C8C33BD2E3DD873E08C94B203BA9F9475089CEB293631BEF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 UK Qualified Authentication CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified Authentication CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 784AA9168DA6A9D69C34321720989C13
- SHA-256: 1DBC5465732AC3232FF12641C2898EA0F239D06186DD1B085496ABC6E5BD07F2
- SPKI SHA-256: 4586F23BCE9C981B8C477ECC4337E3394BCCFEF11CA9A447C43DB5B2902B13A6
- Validity: 2020-09-16 to 2030-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45ukqualauthca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:16:8d:a6:a9:d6:9c:34:32:17:20:98:9c:13
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2030 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC E45 UK Qualified Authentication CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                98:84:2B:94:0B:25:1D:C8:C7:C8:12:7F:D1:86:7D:BF:B1:80:23:E5
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1DBC5465732AC3232FF12641C2898EA0F239D06186DD1B085496ABC6E5BD07F2
    SPKI SHA256: 4586F23BCE9C981B8C477ECC4337E3394BCCFEF11CA9A447C43DB5B2902B13A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 UK Qualified QSCD Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified QSCD Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 784AA919C4052D476FADEAC9DEDB59BB
- SHA-256: 712C42F3C0FA3BDFA11B22AC9811C8EB912C4B464B43C705825DEEDC1195AD33
- SPKI SHA-256: ABFB13E9707122641BBD207989D2439D3F82D68C813F8A30F0A4540DC86E562D
- Validity: 2020-09-16 to 2030-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45ukqualqscdsignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:19:c4:05:2d:47:6f:ad:ea:c9:de:db:59:bb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2030 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC E45 UK Qualified QSCD Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:4C:84:0A:86:65:75:F5:28:1A:33:AF:18:14:B2:2B:6B:CA:3E:15
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 712C42F3C0FA3BDFA11B22AC9811C8EB912C4B464B43C705825DEEDC1195AD33
    SPKI SHA256: ABFB13E9707122641BBD207989D2439D3F82D68C813F8A30F0A4540DC86E562D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E45 UK Qualified Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E45 UK Qualified Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 784AA921B4B7E0AACE95C833D4B7643F
- SHA-256: 28CB8EE23E7BDBBF40B2959A57BB589991C2635CD3B71AAB0E84F993C559D29F
- SPKI SHA-256: 081B71DA35434ED064AB6AC3295E9385DB2867FACC234C3393A1007F5143A33D
- Validity: 2020-09-16 to 2030-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce45ukqualsignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:21:b4:b7:e0:aa:ce:95:c8:33:d4:b7:64:3f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2030 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC E45 UK Qualified Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                93:63:5F:5E:AD:D7:B8:D6:4C:C7:E7:C6:23:5D:4C:EA:B6:D0:40:24
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 28CB8EE23E7BDBBF40B2959A57BB589991C2635CD3B71AAB0E84F993C559D29F
    SPKI SHA256: 081B71DA35434ED064AB6AC3295E9385DB2867FACC234C3393A1007F5143A33D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E46 DV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 DV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 844358AB1EF507BF83CD9AEC57D69D68
- SHA-256: 216D556D2F305606357A52F311CB825ABBB7227571B3522DF0F823600007D2ED
- SPKI SHA-256: D3E1D59BD78048AAB05CFD1C9FBEFD0BCFB64D168F4F78CDC37B9B66750A6478
- Validity: 2025-09-17 to 2029-06-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce46dvtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:ab:1e:f5:07:bf:83:cd:9a:ec:57:d6:9d:68
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Sep 17 02:56:17 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E46 DV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C6:F3:3B:2C:71:C4:A3:DD:BC:6C:F2:A4:38:CD:8C:F6:7A:B5:9B:A6
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 216D556D2F305606357A52F311CB825ABBB7227571B3522DF0F823600007D2ED
    SPKI SHA256: D3E1D59BD78048AAB05CFD1C9FBEFD0BCFB64D168F4F78CDC37B9B66750A6478
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E46 EV QWAC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 EV QWAC CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 780318298233EAFD42A93AF28B03C837
- SHA-256: AA76C50166CD1B865B78D795C2C87A48D4A6229E65F8B38DBD005154EB2ED2DC
- SPKI SHA-256: B39764442367C4576F48968F6E324462E7E3AA10FCE4C892CEEA00F6798615AE
- Validity: 2020-07-28 to 2029-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:29:82:33:ea:fd:42:a9:3a:f2:8b:03:c8:37
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E46 EV QWAC CA 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9A:74:86:BA:1C:12:E3:76:72:DC:1B:8D:E8:38:27:30:30:04:66:8B
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AA76C50166CD1B865B78D795C2C87A48D4A6229E65F8B38DBD005154EB2ED2DC
    SPKI SHA256: B39764442367C4576F48968F6E324462E7E3AA10FCE4C892CEEA00F6798615AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E46 EV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 EV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 844358BB73D1295B3F9D3244EBA281A8
- SHA-256: D077F277688DD5141029DD84D02F51966E1F337B5CFED88C5BBD61929EB3B748
- SPKI SHA-256: 51F663DCB113198DD5291D45DEBD5CFA74DDE03006F34C24E8B94681E1886D92
- Validity: 2025-09-17 to 2029-06-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce46evtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:bb:73:d1:29:5b:3f:9d:32:44:eb:a2:81:a8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Sep 17 02:56:30 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E46 EV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A3:FC:73:83:9F:9E:7B:C2:B8:CF:92:31:36:4A:D8:FF:4A:4B:EB:72
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D077F277688DD5141029DD84D02F51966E1F337B5CFED88C5BBD61929EB3B748
    SPKI SHA256: 51F663DCB113198DD5291D45DEBD5CFA74DDE03006F34C24E8B94681E1886D92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E46 OV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 844358B3B93F5386DEA5EFDE030B8B30
- SHA-256: 66F815D7925CBB2537BFEAA24A0041F7DDEF90E5D4717B16C21CCC0447A5B6FB
- SPKI SHA-256: 97D979AEC0B19D67D2EECB75916DC4A944437BA818B69AC0997F1EB745E91480
- Validity: 2025-09-17 to 2029-06-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:b3:b9:3f:53:86:de:a5:ef:de:03:0b:8b:30
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Sep 17 02:56:24 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2A:94:7F:C7:E0:77:BC:F3:94:2A:80:14:56:A7:80:87:38:CD:4A:B2
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 66F815D7925CBB2537BFEAA24A0041F7DDEF90E5D4717B16C21CCC0447A5B6FB
    SPKI SHA256: 97D979AEC0B19D67D2EECB75916DC4A944437BA818B69AC0997F1EB745E91480
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E46 UK EV QWAC CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E46 UK EV QWAC CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 784AA927850ADDCD70E2A79E26023CC6
- SHA-256: 8814C0688344DE0F21AD1BD076E9F3248AF430E4FE760952E3A150DFAEDCE016
- SPKI SHA-256: 2543E4EFD6AFDF84F0E770CC286E13A17B3F614ED48306DCB83B0C01C06174BB
- Validity: 2020-09-16 to 2029-09-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:27:85:0a:dd:cd:70:e2:a7:9e:26:02:3c:c6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2029 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC E46 UK EV QWAC CA 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:F6:3E:FA:A5:00:1D:BC:F7:7E:FB:A7:AC:9A:AC:D1:16:32:7E:C2
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8814C0688344DE0F21AD1BD076E9F3248AF430E4FE760952E3A150DFAEDCE016
    SPKI SHA256: 2543E4EFD6AFDF84F0E770CC286E13A17B3F614ED48306DCB83B0C01C06174BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E5 EV QWAC CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC E5 EV QWAC CA 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79299B82FC0F3A55C69621C7B8221B5F
- SHA-256: 0DD2C7E0AF8200F49F4192A89AE634D4CE41B80C63B0629CC68E538C316F020E
- SPKI SHA-256: 7B7140140E8F1E6217AF29E0C4F303224716F12EEAEFD7F982A254540A69DE96
- Validity: 2021-03-24 to 2030-03-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce5evqwacca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9b:82:fc:0f:3a:55:c6:96:21:c7:b8:22:1b:5f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 24 00:00:00 2021 GMT
            Not After : Mar 24 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC E5 EV QWAC CA 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C4:7B:82:D1:4C:3A:27:03:02:97:99:AD:AE:46:A7:44:A9:D3:EB:7E
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0DD2C7E0AF8200F49F4192A89AE634D4CE41B80C63B0629CC68E538C316F020E
    SPKI SHA256: 7B7140140E8F1E6217AF29E0C4F303224716F12EEAEFD7F982A254540A69DE96
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC E5 UK EV QWAC CA 2021

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC E5 UK EV QWAC CA 2021
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79299B8472CCB7521126D9AA4B7C3E1E
- SHA-256: 0966A88729C938F9DCD65BB3C63B608618EAE5183ED1FED752B323089687A20E
- SPKI SHA-256: 1CEF69607C6BA0461E50092BCB132D1C8DE8FD21FAB4CBF0BFEBB40838204047
- Validity: 2021-03-24 to 2030-03-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgcce5ukevqwacca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:29:9b:84:72:cc:b7:52:11:26:d9:aa:4b:7c:3e:1e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 24 00:00:00 2021 GMT
            Not After : Mar 24 00:00:00 2030 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC E5 UK EV QWAC CA 2021
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:BD:7D:D0:19:AF:84:86:A7:3E:FF:51:01:3C:F3:2D:02:70:E3:CE
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0966A88729C938F9DCD65BB3C63B608618EAE5183ED1FED752B323089687A20E
    SPKI SHA256: 1CEF69607C6BA0461E50092BCB132D1C8DE8FD21FAB4CBF0BFEBB40838204047
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R1 OV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R1 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 82E5EDBC3914DF6834D343DEAF70D1AC
- SHA-256: DB24FF7CED7C93246DBAA21F7EFBFD261C423AF1964C0E96F1C20267A0C4C067
- SPKI SHA-256: 2FED27B35F9AD4DEE06DD245D226E3F7EFB6902FD9AEAA97F58113D5369FED1E
- Validity: 2025-02-19 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr1ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:e5:ed:bc:39:14:df:68:34:d3:43:de:af:70:d1:ac
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Feb 19 03:16:12 2025 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R1 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                93:B7:EB:BD:0E:29:78:D3:DE:C0:90:1D:9A:12:CA:4C:FF:1D:1C:95
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DB24FF7CED7C93246DBAA21F7EFBFD261C423AF1964C0E96F1C20267A0C4C067
    SPKI SHA256: 2FED27B35F9AD4DEE06DD245D226E3F7EFB6902FD9AEAA97F58113D5369FED1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r1.crt
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 AlphaSSL CA 2022

- Subject: countryName=BE, organizationName=Globalsign nv-sa, commonName=GlobalSign GCC R3 AlphaSSL CA 2022
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D2A4A504D4C23E41B56A8A42B30910B
- SHA-256: CAC12CEBBCCD240269AF886C3C5EC64622881D676C625FCB7D144DCB3552EBC7
- SPKI SHA-256: EC67BE081E2033F1905B873C41E4206B2C3AD13B8DECF8663299A8157F1842FD
- Validity: 2022-09-21 to 2027-09-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3alphasslca2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:2a:4a:50:4d:4c:23:e4:1b:56:a8:a4:2b:30:91:0b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 21 03:27:12 2022 GMT
            Not After : Sep 21 00:00:00 2027 GMT
        Subject: C = BE, O = Globalsign nv-sa, CN = GlobalSign GCC R3 AlphaSSL CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                12:9C:17:13:C2:37:F6:4C:02:AD:51:90:A8:E0:72:B4:85:00:77:71
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CAC12CEBBCCD240269AF886C3C5EC64622881D676C625FCB7D144DCB3552EBC7
    SPKI SHA256: EC67BE081E2033F1905B873C41E4206B2C3AD13B8DECF8663299A8157F1842FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 DV TLS CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 DV TLS CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 77BD0E0742D5D9E9D049D774D02A6F9A
- SHA-256: 762538439509C411C437D3C567563E1378671281FC4A1464ADD031870843676E
- SPKI SHA-256: 49CEF02F815F3B0F2E79DE70DC9392CEEE4CCC1E3BD4F7EA7723788673186D7E
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3dvtlsca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0e:07:42:d5:d9:e9:d0:49:d7:74:d0:2a:6f:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 DV TLS CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0D:98:C0:73:7F:AB:BD:BD:D9:47:4B:49:AD:0A:4A:0C:AC:3E:C7:7C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 762538439509C411C437D3C567563E1378671281FC4A1464ADD031870843676E
    SPKI SHA256: 49CEF02F815F3B0F2E79DE70DC9392CEEE4CCC1E3BD4F7EA7723788673186D7E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 EV QWAC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 EV QWAC CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803182702CF9B1ABAB86046A0F6A8AE
- SHA-256: D4A5941C7141ED1949A0C6CE9DD45A0AB94DC337902EB0A1209852738EEBE854
- SPKI SHA-256: E958A991DEE8153C218FF679E1BEF5BE39B0AB468425CE8A9216AB726CC6695E
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3evqwacca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:27:02:cf:9b:1a:ba:b8:60:46:a0:f6:a8:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 EV QWAC CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DC:BD:DE:59:AD:FD:9B:55:17:E7:70:4C:06:57:9F:21:22:B0:77:00
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D4A5941C7141ED1949A0C6CE9DD45A0AB94DC337902EB0A1209852738EEBE854
    SPKI SHA256: E958A991DEE8153C218FF679E1BEF5BE39B0AB468425CE8A9216AB726CC6695E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 EV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 EV TLS CA 2025
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 83DA866C9F52D51A9318B8D0E7C03169
- SHA-256: 1B2928021A4B89CF0F572A2436E914E25412AD58EDEE221E6C7C3C5437179A26
- SPKI SHA-256: 1EAE8466AEA6BAE8EE445A6008B5186185879330D96F60509EE0154C1C933CC3
- Validity: 2025-07-16 to 2027-07-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3evtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:6c:9f:52:d5:1a:93:18:b8:d0:e7:c0:31:69
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 16 03:05:46 2025 GMT
            Not After : Jul 16 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 EV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                63:10:7F:E4:28:33:9A:F8:47:60:59:52:7E:57:10:C7:4D:F8:17:16
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1B2928021A4B89CF0F572A2436E914E25412AD58EDEE221E6C7C3C5437179A26
    SPKI SHA256: 1EAE8466AEA6BAE8EE445A6008B5186185879330D96F60509EE0154C1C933CC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R3 OV TLS CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB98E46F35B91C2FFA178718C85A
- SHA-256: 996BB81F161E1DAC9A3939AB7A42B4131D6DCFBE6E0DA4B5A6E19B5C8701842A
- SPKI SHA-256: 3773EA6DF06BCD05B63FABEE7F3F825ECF63EA4B9F12D66076187E43686B4945
- Validity: 2024-09-18 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:98:e4:6f:35:b9:1c:2f:fa:17:87:18:c8:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:14:38 2024 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:D3:A8:08:48:0C:34:37:58:EE:E5:A7:75:2E:59:FC:D6:DC:3C:38
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 996BB81F161E1DAC9A3939AB7A42B4131D6DCFBE6E0DA4B5A6E19B5C8701842A
    SPKI SHA256: 3773EA6DF06BCD05B63FABEE7F3F825ECF63EA4B9F12D66076187E43686B4945
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 PersonalSign 1 CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 PersonalSign 1 CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AA91218D1A42608513CD3665543A3
- SHA-256: 583C7FC250856B7F947FC7CC076FE216273CA1713D122C2E5D8F6038FD6E3562
- SPKI SHA-256: C11651233472248EB54E061F181288D066096FFD9A90F251B4EBE1E6838D2C4C
- Validity: 2020-09-16 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3personalsign1ca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:12:18:d1:a4:26:08:51:3c:d3:66:55:43:a3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 PersonalSign 1 CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                85:BB:F0:CC:C4:36:B5:0A:62:76:A3:99:2E:8F:BB:3A:6A:AD:C5:51
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 583C7FC250856B7F947FC7CC076FE216273CA1713D122C2E5D8F6038FD6E3562
    SPKI SHA256: C11651233472248EB54E061F181288D066096FFD9A90F251B4EBE1E6838D2C4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 PersonalSign 2 CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R3 PersonalSign 2 CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AA9103FA5BFBEDE7508B134931D00
- SHA-256: F0DBB9E90E6643CCB23660147E5DE24760440089D96F4AD0D82F66C3E7DA5C20
- SPKI SHA-256: 724E91A23FEBF0F57961D3875594E8ADE647F9583E907FC896BDCB2D880AADAA
- Validity: 2020-09-16 to 2028-09-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3personalsign2ca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:10:3f:a5:bf:be:de:75:08:b1:34:93:1d:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R3 PersonalSign 2 CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:33:D1:E6:58:17:5B:34:75:8A:81:56:64:D5:BE:48:DE:A1:8F:CF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F0DBB9E90E6643CCB23660147E5DE24760440089D96F4AD0D82F66C3E7DA5C20
    SPKI SHA256: 724E91A23FEBF0F57961D3875594E8ADE647F9583E907FC896BDCB2D880AADAA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R3 UK EV QWAC CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R3 UK EV QWAC CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AA926B6E75BEFAD77B34801B952D0
- SHA-256: A33017D9DF494C09D58709107403AEE461B9461E81BA395C28C36693C27D1986
- SPKI SHA-256: FDC2CD22CF743EEE33AE99C1B89740FB04E5D81AF1115523BA9F8C14E332AF58
- Validity: 2020-09-16 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr3ukevqwacca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:26:b6:e7:5b:ef:ad:77:b3:48:01:b9:52:d0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC R3 UK EV QWAC CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                07:94:36:4A:51:95:49:FD:EE:2A:06:79:36:7F:C2:37:3B:4E:DB:BF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A33017D9DF494C09D58709107403AEE461B9461E81BA395C28C36693C27D1986
    SPKI SHA256: FDC2CD22CF743EEE33AE99C1B89740FB04E5D81AF1115523BA9F8C14E332AF58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R42 Verified Mark CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R42 Verified Mark CA 2023
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Verified Mark Root R42
- Serial: 7FE530930B864A36EF80BA8686C1A9AE
- SHA-256: 0FA93B3456322B7672C6B9616E09944E091E9DBDC63FF029B110400688CD4983
- SPKI SHA-256: F832DB28FF138116F017A3C6DC2ACE40AAC23C6BAD42DA5B6EA83BBEE93210B9
- Validity: 2023-11-15 to 2038-11-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr42verifiedmarkca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/gsverifiedmarkrootr42
- CRL DP: http://crl.globalsign.com/gsverifiedmarkrootr42.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:e5:30:93:0b:86:4a:36:ef:80:ba:86:86:c1:a9:ae
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Verified Mark Root R42
        Validity
            Not Before: Nov 15 03:42:46 2023 GMT
            Not After : Nov 15 00:00:00 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R42 Verified Mark CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Brand Indicator for Message Identification
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8C:D8:30:07:82:CE:11:51:FA:0B:B7:EF:B7:46:95:72:C1:76:B3:4E
            X509v3 Authority Key Identifier:
                3D:B3:E3:F5:20:AE:B9:D3:AC:9B:14:BC:70:25:EE:0F:0A:7E:95:C9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsverifiedmarkrootr42
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsverifiedmarkrootr42.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsverifiedmarkrootr42.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0FA93B3456322B7672C6B9616E09944E091E9DBDC63FF029B110400688CD4983
    SPKI SHA256: F832DB28FF138116F017A3C6DC2ACE40AAC23C6BAD42DA5B6EA83BBEE93210B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/gsverifiedmarkrootr42
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsverifiedmarkrootr42.crt
- CRL Distribution Points: http://crl.globalsign.com/gsverifiedmarkrootr42.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 AATL CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 784AA9036A7D8E8AC07448D709ACAAB3
- SHA-256: BCF8D9040635C95E84F9FEDDF36F9422C0D215C23798E9C2D5F3798ECF27B68A
- SPKI SHA-256: DEC7F7F4ECA3EF6377090ECC03045834E129CD19896FF5CB743746DD919A3D73
- Validity: 2020-09-16 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45aatlca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:03:6a:7d:8e:8a:c0:74:48:d7:09:ac:aa:b3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 AATL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:C0:6F:C3:D6:71:0D:E8:F1:42:D6:BF:F6:E6:ED:8E:F1:05:AC:CA
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BCF8D9040635C95E84F9FEDDF36F9422C0D215C23798E9C2D5F3798ECF27B68A
    SPKI SHA256: DEC7F7F4ECA3EF6377090ECC03045834E129CD19896FF5CB743746DD919A3D73
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 AATL CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Serial: 85151BCE2472CE9F52CF2BC22E350809
- SHA-256: 9002756176624D1DA91D402496A40DDD81CAF3A6ABBC84B90BC7B6A6A442C09B
- SPKI SHA-256: 8B962DC12B05B0113107910B11418846A4875DD1630D8AE865CFB0EC7A107DFD
- Validity: 2026-01-21 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- CRL DP: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:1b:ce:24:72:ce:9f:52:cf:2b:c2:2e:35:08:09
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Validity
            Not Before: Jan 21 04:20:56 2026 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 AATL CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B8:DE:CF:08:E0:0E:DF:49:2A:AB:4A:09:A8:21:25:D6:99:4B:E5:BC
            X509v3 Authority Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatlrootca2020
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatlrootca2020.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 9002756176624D1DA91D402496A40DDD81CAF3A6ABBC84B90BC7B6A6A442C09B
    SPKI SHA256: 8B962DC12B05B0113107910B11418846A4875DD1630D8AE865CFB0EC7A107DFD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatlrootca2020
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatlrootca2020.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 AATL CA 2026 2H

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 AATL CA 2026 2H
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Trusted CA 2026
- Serial: 8644012EB61BB30ADAB1F10E9A54C275
- SHA-256: 3528F79DD8E326D05BEECCA2045EB7515E4F92A30B4B7762B8B442EC8777D811
- SPKI SHA-256: BE897D2B6F3990B896B39FD4C90A1F048EBCFEAC9EBB9EDE5E160DD3171C0802
- Validity: 2026-07-22 to 2041-06-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatltrustedca2026
- CRL DP: http://crl.globalsign.com/gsr45aatltrustedca2026.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:44:01:2e:b6:1b:b3:0a:da:b1:f1:0e:9a:54:c2:75
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Trusted CA 2026
        Validity
            Not Before: Jul 22 05:01:56 2026 GMT
            Not After : Jun 23 12:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 AATL CA 2026 2H
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                03:A9:4B:33:34:E6:4C:83:1F:05:18:08:92:CD:E9:96:D8:B7:61:B2
            X509v3 Authority Key Identifier:
                CB:1F:C5:15:82:36:0C:A6:52:B9:92:2A:2C:F2:B6:99:41:C7:2E:68
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsr45aatltrustedca2026
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsr45aatltrustedca2026.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsr45aatltrustedca2026.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3528F79DD8E326D05BEECCA2045EB7515E4F92A30B4B7762B8B442EC8777D811
    SPKI SHA256: BE897D2B6F3990B896B39FD4C90A1F048EBCFEAC9EBB9EDE5E160DD3171C0802
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsr45aatltrustedca2026
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsr45aatltrustedca2026.crt
- CRL Distribution Points: http://crl.globalsign.com/gsr45aatltrustedca2026.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 Client Authentication CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Client Authentication CA 2024
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 814E424EE74801ED9D29F783E4BEE61A
- SHA-256: B642FE0BEEDA939226D98030811804987283E4F20B5638F9AA74C1650D3F7A10
- SPKI SHA-256: EC51EA646B8149402F20B196449DE46A77AA0001849D7F1A86E865D67B8A5A9C
- Validity: 2024-06-19 to 2034-06-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45clientauthca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:42:4e:e7:48:01:ed:9d:29:f7:83:e4:be:e6:1a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Jun 19 03:25:55 2024 GMT
            Not After : Jun 19 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Client Authentication CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                30:54:40:1F:A3:A3:70:94:58:BE:C0:18:15:89:5D:40:5B:0B:6A:34
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B642FE0BEEDA939226D98030811804987283E4F20B5638F9AA74C1650D3F7A10
    SPKI SHA256: EC51EA646B8149402F20B196449DE46A77AA0001849D7F1A86E865D67B8A5A9C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, ipsec Internet Key Exchange, IPSec User, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 CodeSigning CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 CodeSigning CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Serial: 77BD0E03A1B708F854AB067210D90447
- SHA-256: 74D499A72D0BA5D4DDEC55805ECF157C891E45E5D490A19DC5FD4476954E774B
- SPKI SHA-256: 7E86A79A228177F4BE0DFEC84967936CBD29281A5E2F49F932576A00886C9904
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45codesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- CRL DP: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 CodeSigning CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:B3:8D:C0:24:90:A3:6B:77:D3:0C:A0:59:DD:21:67:64:76:0B:78
            X509v3 Authority Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/codesigningrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/codesigningrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/codesigningrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.4.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74D499A72D0BA5D4DDEC55805ECF157C891E45E5D490A19DC5FD4476954E774B
    SPKI SHA256: 7E86A79A228177F4BE0DFEC84967936CBD29281A5E2F49F932576A00886C9904
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.50, 2.23.140.1.4.1
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/codesigningrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 CodeSigning CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 CodeSigning CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Serial: 814E4217A1297FED5ACCD417F891AD75
- SHA-256: 1D577890A6F07BFBF7CD7C30F9EC0CA935DBA846F9F02BA8B77ACE6BA4F767A3
- SPKI SHA-256: 7E86A79A228177F4BE0DFEC84967936CBD29281A5E2F49F932576A00886C9904
- Validity: 2024-06-19 to 2038-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45codesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.10.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- CRL DP: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Validity
            Not Before: Jun 19 03:25:11 2024 GMT
            Not After : Jul 28 00:00:00 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 CodeSigning CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:B3:8D:C0:24:90:A3:6B:77:D3:0C:A0:59:DD:21:67:64:76:0B:78
            X509v3 Authority Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/codesigningrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/codesigningrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/codesigningrootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.4146.1.50
                Policy: 1.3.6.1.4.1.4146.10.4.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1D577890A6F07BFBF7CD7C30F9EC0CA935DBA846F9F02BA8B77ACE6BA4F767A3
    SPKI SHA256: 7E86A79A228177F4BE0DFEC84967936CBD29281A5E2F49F932576A00886C9904
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.4146.1.50, 1.3.6.1.4.1.4146.10.4.2
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/codesigningrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 EV CodeSigning CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 EV CodeSigning CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Serial: 77BD0E05B7590BB61D4761531E3F75ED
- SHA-256: CD0E144DD10BAC221FE2FB901058D16450A0578B3C47C770908F2E9ADA28EF12
- SPKI SHA-256: 55E81B9F02A45FFE3A4B2E35FDB23E4527A2EA112A69538F50B08568D2749321
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- CRL DP: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 EV CodeSigning CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:9D:D0:FC:59:09:86:63:C5:EC:F3:B1:13:3B:57:1C:03:92:36:11
            X509v3 Authority Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/codesigningrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/codesigningrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/codesigningrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.2
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CD0E144DD10BAC221FE2FB901058D16450A0578B3C47C770908F2E9ADA28EF12
    SPKI SHA256: 55E81B9F02A45FFE3A4B2E35FDB23E4527A2EA112A69538F50B08568D2749321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.2, 2.23.140.1.3
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/codesigningrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 EV CodeSigning CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 EV CodeSigning CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Code Signing Root R45
- Serial: 814E423EC48EB1E0D2FDE2E3001D3480
- SHA-256: 3E303F58EDD8C0F3373398BE2C210333D3A2D13DCD16283DEDA94E13D4833313
- SPKI SHA-256: 55E81B9F02A45FFE3A4B2E35FDB23E4527A2EA112A69538F50B08568D2749321
- Validity: 2024-06-19 to 2038-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- CRL DP: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Code Signing Root R45
        Validity
            Not Before: Jun 19 03:25:42 2024 GMT
            Not After : Jul 28 00:00:00 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 EV CodeSigning CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:9D:D0:FC:59:09:86:63:C5:EC:F3:B1:13:3B:57:1C:03:92:36:11
            X509v3 Authority Key Identifier:
                1F:00:BF:46:80:0A:FC:78:39:B7:A5:B4:43:D9:56:50:BB:CE:96:3B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/codesigningrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/codesigningrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/codesigningrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3E303F58EDD8C0F3373398BE2C210333D3A2D13DCD16283DEDA94E13D4833313
    SPKI SHA256: 55E81B9F02A45FFE3A4B2E35FDB23E4527A2EA112A69538F50B08568D2749321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/codesigningrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/codesigningrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/codesigningrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 PersonalSign 3 CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 784AAA166E730A98DDA60C13694890F2
- SHA-256: 50161C1232F32E8057879F9C7651A9088F5AA1EF5AC9A9A4BD445C6E788EA6F8
- SPKI SHA-256: 4734AE926532146682C6703EFF9AA263C8298CA5463151B59690C88FFF89A706
- Validity: 2020-10-21 to 2025-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45personalsign3ca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:16:6e:73:0a:98:dd:a6:0c:13:69:48:90:f2
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Oct 21 00:00:00 2020 GMT
            Not After : Oct 21 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 PersonalSign 3 CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:D9:3C:82:EB:DF:08:45:A1:88:6C:42:9E:DB:52:B8:3B:69:70:28
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 50161C1232F32E8057879F9C7651A9088F5AA1EF5AC9A9A4BD445C6E788EA6F8
    SPKI SHA256: 4734AE926532146682C6703EFF9AA263C8298CA5463151B59690C88FFF89A706
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.60
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R45 PersonalSign 3 CA 2022

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 7C58A0D7AFB02A48993FEFB7BABDC452
- SHA-256: 9153DB840DA0BDD27A0A2FCA32E4E278AF54C3580F3C45FACA402C70E6E4DA5C
- SPKI SHA-256: CA10DF5C6B5E2D8C14C2DCB64FFAEB415DD3A00BE328927AA2201D8221A5ABAE
- Validity: 2022-05-18 to 2029-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45personalsign3ca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:58:a0:d7:af:b0:2a:48:99:3f:ef:b7:ba:bd:c4:52
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: May 18 12:00:00 2022 GMT
            Not After : May 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 PersonalSign 3 CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:A8:6D:1C:21:5B:B9:1D:0D:C1:88:9C:FF:4F:1A:42:FF:84:C1:3B
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.2.1
                Policy: 1.3.6.1.4.1.4146.1.40.60
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 9153DB840DA0BDD27A0A2FCA32E4E278AF54C3580F3C45FACA402C70E6E4DA5C
    SPKI SHA256: CA10DF5C6B5E2D8C14C2DCB64FFAEB415DD3A00BE328927AA2201D8221A5ABAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 PersonalSign 3 CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 PersonalSign 3 CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 85AC70D79736A1E2262412527EB4152D
- SHA-256: D50946D503951CB390B7E92F87EB057C280E7B94C4E49ED74373AA4AF532F0B1
- SPKI SHA-256: ECEDF1047DE3C8FF89136B022F1CA2732EE69E560037ADB9E39E34C6FFFDE098
- Validity: 2026-04-22 to 2036-04-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45personalsign3ca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:ac:70:d7:97:36:a1:e2:26:24:12:52:7e:b4:15:2d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Apr 22 03:01:12 2026 GMT
            Not After : Apr 22 00:00:00 2036 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 PersonalSign 3 CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                24:C3:9F:40:37:A3:33:9B:18:CE:D3:6A:D1:D9:ED:25:CD:1E:76:CB
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.2.1
                Policy: 1.3.6.1.4.1.4146.1.40.60
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: D50946D503951CB390B7E92F87EB057C280E7B94C4E49ED74373AA4AF532F0B1
    SPKI SHA256: ECEDF1047DE3C8FF89136B022F1CA2732EE69E560037ADB9E39E34C6FFFDE098
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.1, 1.3.6.1.4.1.4146.1.40.60
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 Qualified Authentication CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 78031881B3DF31D2F4D29D886B400A9C
- SHA-256: E042DA36AA8B9A290A525B63AFBBD42E3DBA8286F7100C7981799C6EF2F8919C
- SPKI SHA-256: 480EABE2C90CEEFA1DE68CC1C207E2ED86AC3FA10F10483681C11FC9E11F1CF6
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45qualauthca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:81:b3:df:31:d2:f4:d2:9d:88:6b:40:0a:9c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Qualified Authentication CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                11:86:83:91:62:5F:BA:68:33:96:64:30:9E:F2:85:B8:F2:F3:2D:72
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: E042DA36AA8B9A290A525B63AFBBD42E3DBA8286F7100C7981799C6EF2F8919C
    SPKI SHA256: 480EABE2C90CEEFA1DE68CC1C207E2ED86AC3FA10F10483681C11FC9E11F1CF6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R45 Qualified QSCD Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 78031888570E57F5EE4FA48613C533B7
- SHA-256: 1B728D4A76506634A11007912F1D8C6B9AA39BE1AFCA49096657CF1FFB4513BF
- SPKI SHA-256: BC15C4536A39E48D61101633E7E73E6C38D830A2702750AA307A0B92DE6E2018
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45qualqscdsignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:88:57:0e:57:f5:ee:4f:a4:86:13:c5:33:b7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Qualified QSCD Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                05:BA:5B:3A:77:14:2C:87:86:46:FC:70:16:5F:62:75:99:74:A1:18
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 1B728D4A76506634A11007912F1D8C6B9AA39BE1AFCA49096657CF1FFB4513BF
    SPKI SHA256: BC15C4536A39E48D61101633E7E73E6C38D830A2702750AA307A0B92DE6E2018
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R45 Qualified QSCD Signing CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified QSCD Signing CA 2024, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 8088415AB1D054A878009B779D60F5B0
- SHA-256: 13D7E765FE222EC2590008EF8EF43C0C9BC256B87F2705B16D80AAB256843040
- SPKI SHA-256: 2269FA916F0C56DEE9A919FEC9965AA636E4D4C7C60509B230F56CAD6F1BD50A
- Validity: 2024-02-21 to 2030-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:88:41:5a:b1:d0:54:a8:78:00:9b:77:9d:60:f5:b0
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Feb 21 03:36:53 2024 GMT
            Not After : Feb 21 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Qualified QSCD Signing CA 2024, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4E:F6:7C:D7:A2:AE:F5:E5:B5:17:77:42:77:40:3C:B9:9C:64:59:C7
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 13D7E765FE222EC2590008EF8EF43C0C9BC256B87F2705B16D80AAB256843040
    SPKI SHA256: 2269FA916F0C56DEE9A919FEC9965AA636E4D4C7C60509B230F56CAD6F1BD50A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 Qualified Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 78031894BC6BB2D1473E9F73CB4B62AC
- SHA-256: 4E1474CFEB41D048C7E1E2C975D69AD3FD739BD44577A80D0432F233D51C5C77
- SPKI SHA-256: 3B719B31374EC4F9B694DB35EA5386C08F6D6EAFEAABAE2848B7F5507DA27D27
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45qualsignca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:94:bc:6b:b2:d1:47:3e:9f:73:cb:4b:62:ac
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Qualified Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                21:5F:0D:66:9A:BC:22:A8:96:CE:3E:ED:9A:99:FC:AF:3C:93:FB:EA
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4E1474CFEB41D048C7E1E2C975D69AD3FD739BD44577A80D0432F233D51C5C77
    SPKI SHA256: 3B719B31374EC4F9B694DB35EA5386C08F6D6EAFEAABAE2848B7F5507DA27D27
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R45 Qualified Signing CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 Qualified Signing CA 2024, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 8088415147B092452B3CBA31B43BFDC4
- SHA-256: 4586A569DFD4C8DDBC4703805A14F9FDADF3D6C7CEFCC127868A49B21FFA7C76
- SPKI SHA-256: 6931AA09E72D69D97E009FA436B710AD31F39CC0EDC08E6FDAD36DC427F961C3
- Validity: 2024-02-21 to 2030-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:88:41:51:47:b0:92:45:2b:3c:ba:31:b4:3b:fd:c4
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Feb 21 03:36:46 2024 GMT
            Not After : Feb 21 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 Qualified Signing CA 2024, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8C:B9:23:5C:B8:5F:2F:FC:9E:B8:8E:CC:51:B6:B0:9E:2B:10:B1:B5
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4586A569DFD4C8DDBC4703805A14F9FDADF3D6C7CEFCC127868A49B21FFA7C76
    SPKI SHA256: 6931AA09E72D69D97E009FA436B710AD31F39CC0EDC08E6FDAD36DC427F961C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 SMIME CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 82E5EDD57308D4CF636BA6000CB3171C
- SHA-256: 488F465D575607BC7CB7974CA7E6F4F5BCF76D9472719260DF902E73E0B87714
- SPKI SHA-256: A017960D8E70566633EA9ADA854D2FF6583E01DA9AF451F3707EBDCCB792F214
- Validity: 2025-02-19 to 2030-02-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:e5:ed:d5:73:08:d4:cf:63:6b:a6:00:0c:b3:17:1c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Feb 19 03:16:32 2025 GMT
            Not After : Feb 19 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D9:A4:A0:27:CB:0A:24:AA:31:AA:43:7D:73:70:CC:7F:B5:25:BB:93
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 488F465D575607BC7CB7974CA7E6F4F5BCF76D9472719260DF902E73E0B87714
    SPKI SHA256: A017960D8E70566633EA9ADA854D2FF6583E01DA9AF451F3707EBDCCB792F214
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R45 UK Qualified Authentication CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified Authentication CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 784AA914066FBC7BC86AAB84163CD94A
- SHA-256: EEE8A6FBDE0B1340552AE739832A686FE96103435AE1FCE9392D655E00D8670D
- SPKI SHA-256: 97928C4C09F33C5CE68727FF490A4C233CE8AB72281D753BFDC400493E06E623
- Validity: 2020-09-16 to 2026-09-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45ukqualauthca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:14:06:6f:bc:7b:c8:6a:ab:84:16:3c:d9:4a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2026 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC R45 UK Qualified Authentication CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                52:79:88:D4:4C:D8:3A:03:DF:CD:86:FF:1C:8B:EA:C6:71:AB:E9:4B
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: EEE8A6FBDE0B1340552AE739832A686FE96103435AE1FCE9392D655E00D8670D
    SPKI SHA256: 97928C4C09F33C5CE68727FF490A4C233CE8AB72281D753BFDC400493E06E623
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R45 UK Qualified QSCD Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified QSCD Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 784AA9189D043588BC848FB8F7DBCD5A
- SHA-256: 91F881C556A920B92C4C48221FAAC19615437CF4ACB7D079C0B426BF3483B3AE
- SPKI SHA-256: F50117F833136684EFD633CBB4C1514A129799875B485FAC834F400CF353ECC3
- Validity: 2020-09-16 to 2026-09-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45ukqualqscdsignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:18:9d:04:35:88:bc:84:8f:b8:f7:db:cd:5a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2026 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC R45 UK Qualified QSCD Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                47:5C:8F:E5:C4:E4:E6:9E:82:13:7B:E7:D8:10:E8:9A:4F:68:2D:BE
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 91F881C556A920B92C4C48221FAAC19615437CF4ACB7D079C0B426BF3483B3AE
    SPKI SHA256: F50117F833136684EFD633CBB4C1514A129799875B485FAC834F400CF353ECC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R45 UK Qualified Signing CA 2020

- Subject: countryName=GB, organizationName=GMO GlobalSign Ltd, commonName=GlobalSign GCC R45 UK Qualified Signing CA 2020, organizationIdentifier=NTRGB-04705639
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 784AA9206C02BF46D2380A3474C96BD2
- SHA-256: F5E9E2705AB0C93E80652D2DEB573AB01D6700597BDA122BC08BA97FDC713368
- SPKI SHA-256: 52FC21C6AFD8E4862FAC6E83EF3381F7C7C8B2D77EC1D43F52009C556347B5B5
- Validity: 2020-09-16 to 2026-09-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr45ukqualsignca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:20:6c:02:bf:46:d2:38:0a:34:74:c9:6b:d2
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2026 GMT
        Subject: C = GB, O = GMO GlobalSign Ltd, CN = GlobalSign GCC R45 UK Qualified Signing CA 2020, organizationIdentifier = NTRGB-04705639
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:15:E5:30:6F:30:28:A1:13:95:6A:DA:A5:05:2A:D3:68:FD:0E:A0
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: F5E9E2705AB0C93E80652D2DEB573AB01D6700597BDA122BC08BA97FDC713368
    SPKI SHA256: 52FC21C6AFD8E4862FAC6E83EF3381F7C7C8B2D77EC1D43F52009C556347B5B5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R46 AlphaSSL CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 AlphaSSL CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8443586F6396264381337C801A2E6118
- SHA-256: D2AC9DCC7A255029A5F5180D63F1A9ED60E11412A85C148D4B71F6AE1A36695C
- SPKI SHA-256: 68EB3244103493314D6599E4B028F9DEE1F94849757AA6CF01B4C6116CE2C525
- Validity: 2025-09-17 to 2029-06-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr46alphasslca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:6f:63:96:26:43:81:33:7c:80:1a:2e:61:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Sep 17 02:55:30 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R46 AlphaSSL CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A3:4C:AC:B1:BF:B4:88:ED:8B:74:D8:5F:34:38:C9:E9:0A:25:9E:7B
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D2AC9DCC7A255029A5F5180D63F1A9ED60E11412A85C148D4B71F6AE1A36695C
    SPKI SHA256: 68EB3244103493314D6599E4B028F9DEE1F94849757AA6CF01B4C6116CE2C525
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R46 DV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 DV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8443588121DB5AB28499FFAE80670BA4
- SHA-256: B59410F367B986E98E53A9789A6580553A74BE515211D9F6ECB6E8A11E83AEAA
- SPKI SHA-256: AA56B63D04F91AB222969CA73B6B3A470B829EEA0D99AFAAB948BA9F0E229D83
- Validity: 2025-09-17 to 2029-06-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr46dvtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:81:21:db:5a:b2:84:99:ff:ae:80:67:0b:a4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Sep 17 02:55:44 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R46 DV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:69:E9:7F:A5:AB:F4:C3:61:E5:CD:8E:7B:47:EF:8B:29:64:8D:EC
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B59410F367B986E98E53A9789A6580553A74BE515211D9F6ECB6E8A11E83AEAA
    SPKI SHA256: AA56B63D04F91AB222969CA73B6B3A470B829EEA0D99AFAAB948BA9F0E229D83
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R46 EV QWAC CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 EV QWAC CA 2025, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 831489E47364877147B6230EBBE1B17E
- SHA-256: C12FE52A74D33B88439FEAFBDCE47EAEEB881A3CA42078FDF13C0FF4E39B8161
- SPKI SHA-256: 861FB2A6826B0E62B8147E81580AEFF8EC11312918D8DC46CD4FBAD4FC04AF35
- Validity: 2025-03-19 to 2031-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr46evqwac2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:89:e4:73:64:87:71:47:b6:23:0e:bb:e1:b1:7e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Mar 19 03:31:41 2025 GMT
            Not After : Mar 19 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R46 EV QWAC CA 2025, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:D3:65:85:DC:80:7C:18:15:0B:CD:0D:E8:6F:9C:91:D7:A9:C1:C7
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C12FE52A74D33B88439FEAFBDCE47EAEEB881A3CA42078FDF13C0FF4E39B8161
    SPKI SHA256: 861FB2A6826B0E62B8147E81580AEFF8EC11312918D8DC46CD4FBAD4FC04AF35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R46 EV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 EV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8443589D315FF148D3C5A5540E228F43
- SHA-256: 73CB0FD1FE764CE7605F77BCE71DFEC49E449ED2BB9CC76B6AE7F75691EA6161
- SPKI SHA-256: 3E08D27BD634CD3BD4AB14B57011A07400B4F53262861CE17C5909E53D1C926B
- Validity: 2025-09-17 to 2029-06-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr46evtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:9d:31:5f:f1:48:d3:c5:a5:54:0e:22:8f:43
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Sep 17 02:56:06 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R46 EV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:62:67:03:A3:A2:26:64:06:1A:30:05:03:BF:CD:A1:53:E1:0D:52
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 73CB0FD1FE764CE7605F77BCE71DFEC49E449ED2BB9CC76B6AE7F75691EA6161
    SPKI SHA256: 3E08D27BD634CD3BD4AB14B57011A07400B4F53262861CE17C5909E53D1C926B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R46 OV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84435890836F67394182CB9C9A5DC99F
- SHA-256: D160E2DE4E56CB10B66C1CB0ADCB79CF93C78DCD9DB30C2018220262C04063F9
- SPKI SHA-256: 9D9E10B16C62BC172EB85908F1D5E07DAD0F6F6A35B2367C84AC7A87EEF6F71C
- Validity: 2025-09-17 to 2029-06-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:90:83:6f:67:39:41:82:cb:9c:9a:5d:c9:9f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Sep 17 02:55:56 2025 GMT
            Not After : Jun 23 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                69:74:3E:AF:C3:5B:01:95:49:EE:14:41:5A:93:FA:B1:30:98:DA:A2
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D160E2DE4E56CB10B66C1CB0ADCB79CF93C78DCD9DB30C2018220262C04063F9
    SPKI SHA256: 9D9E10B16C62BC172EB85908F1D5E07DAD0F6F6A35B2367C84AC7A87EEF6F71C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R6 AATL CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AATL CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 784AA90AFB8FFBBC545B4B28B7FCA353
- SHA-256: 75CC6021036890EAC71853FAE8382CF8DB33DC41706F42AAFE421E98AD38174C
- SPKI SHA-256: B87EA8A4A0CABCD51795C48C0B49CB3BB4088DD91E8424C9DC0598BC799E73BB
- Validity: 2020-09-16 to 2030-09-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6aatlca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:a9:0a:fb:8f:fb:bc:54:5b:4b:28:b7:fc:a3:53
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Sep 16 00:00:00 2020 GMT
            Not After : Sep 16 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 AATL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:22:D9:6B:0A:A2:9C:BF:C5:D6:EC:11:56:34:04:3C:AE:0A:D3:6F
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 75CC6021036890EAC71853FAE8382CF8DB33DC41706F42AAFE421E98AD38174C
    SPKI SHA256: B87EA8A4A0CABCD51795C48C0B49CB3BB4088DD91E8424C9DC0598BC799E73BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R6 AlphaSSL CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AlphaSSL CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C902E83D0E3B6FB3BEE478B5E80
- SHA-256: E46FB2A75097A345D4246DCF44A10DAA71D9FD0EBFAB61BA67E6DB84EE5B6CAB
- SPKI SHA-256: 25D14445138D49EA24A4F4701CAA198193CF18EFBB630A0C1C61E87B5040AB77
- Validity: 2023-07-19 to 2026-07-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6alphasslca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:90:2e:83:d0:e3:b6:fb:3b:ee:47:8b:5e:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:43:25 2023 GMT
            Not After : Jul 19 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 AlphaSSL CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BD:05:B7:F3:8A:93:3C:73:CB:79:FA:0F:85:12:A1:77:96:18:91:74
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E46FB2A75097A345D4246DCF44A10DAA71D9FD0EBFAB61BA67E6DB84EE5B6CAB
    SPKI SHA256: 25D14445138D49EA24A4F4701CAA198193CF18EFBB630A0C1C61E87B5040AB77
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R6 AlphaSSL CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 AlphaSSL CA 2025
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 837D4EB89E912FE72CAD3BC7692DDC20
- SHA-256: A883559231F8388DAF35CE41C8101040AE8FD9B656434247B9475AF592CC08CA
- SPKI SHA-256: 1E20888F63520C235F8E61FDEA725CCE1745F233EF8B1CDAE76A24DBB3F2FB59
- Validity: 2025-05-21 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6alphasslca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:7d:4e:b8:9e:91:2f:e7:2c:ad:3b:c7:69:2d:dc:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 21 02:36:52 2025 GMT
            Not After : May 21 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 AlphaSSL CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C5:B4:93:8F:6F:2B:DC:1E:48:BF:B7:10:30:85:CE:D1:B2:BB:48:2D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A883559231F8388DAF35CE41C8101040AE8FD9B656434247B9475AF592CC08CA
    SPKI SHA256: 1E20888F63520C235F8E61FDEA725CCE1745F233EF8B1CDAE76A24DBB3F2FB59
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R6 Authentication CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 Authentication CA 2026
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8587DFFCC4E04064C934AE9A7AD200F4
- SHA-256: 8C8C66EE1974ECCB7BC1C6CC186C0C87B058607F55D8598A647163084644DEEC
- SPKI SHA-256: ED0248B8748F5A2E0DF5FAD6624229CC0BB8642BE7AAE1D0B1A96843F48D240C
- Validity: 2026-03-31 to 2031-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:87:df:fc:c4:e0:40:64:c9:34:ae:9a:7a:d2:00:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 31 03:37:45 2026 GMT
            Not After : Mar 31 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 Authentication CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:2B:35:3C:42:D4:BC:C5:6D:5F:16:6B:30:59:E0:A5:8C:2C:71:78
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C8C66EE1974ECCB7BC1C6CC186C0C87B058607F55D8598A647163084644DEEC
    SPKI SHA256: ED0248B8748F5A2E0DF5FAD6624229CC0BB8642BE7AAE1D0B1A96843F48D240C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R6 OV TLS CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F1F2C994C2A3F948A85955CEFB31726
- SHA-256: 3F6F57F1FE25B3D6F088F17704F7E376AE3A91151DCD8E1917CB3A41785B5F0D
- SPKI SHA-256: 36073CC4A651341277B653D8F09F37308CF5F3B1FDE2D8B547EC46CD5B6845AF
- Validity: 2023-07-19 to 2026-07-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6ovtlsca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:1f:2c:99:4c:2a:3f:94:8a:85:95:5c:ef:b3:17:26
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 19 03:43:32 2023 GMT
            Not After : Jul 19 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 OV TLS CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:35:19:53:02:71:2B:4B:00:57:A1:6A:15:1A:E2:5B:CE:F5:A3:F5
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3F6F57F1FE25B3D6F088F17704F7E376AE3A91151DCD8E1917CB3A41785B5F0D
    SPKI SHA256: 36073CC4A651341277B653D8F09F37308CF5F3B1FDE2D8B547EC46CD5B6845AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign GCC R6 OV TLS CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2025
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8414C88F346B48F795E3666CA7E8B687
- SHA-256: 8E785E7EDB8D8162F3169DB4129C85AB9E4F838A3A92E1914CBED612B2F945EE
- SPKI SHA-256: 7860AFE51132E3A9B67C60494CDFD8634CACFEAEA22035F11511424047327A0D
- Validity: 2025-08-20 to 2026-09-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:14:c8:8f:34:6b:48:f7:95:e3:66:6c:a7:e8:b6:87
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 20 03:21:32 2025 GMT
            Not After : Sep 30 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                80:F7:F5:B8:DE:9E:D3:8E:28:BE:C0:F2:F5:A9:8E:53:19:91:A4:77
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8E785E7EDB8D8162F3169DB4129C85AB9E4F838A3A92E1914CBED612B2F945EE
    SPKI SHA256: 7860AFE51132E3A9B67C60494CDFD8634CACFEAEA22035F11511424047327A0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GlobalSign GCC R6 OV TLS CA 2025 V2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 OV TLS CA 2025 V2
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 8471F491AF12EFD94E567EE681122C2F
- SHA-256: 96777B062F1A1CA0D6F5CDE31BB0012C303DEF52E4691D8D899F66560BCEA9B9
- SPKI SHA-256: 00997DB8240CDB5FF2271EE595BC52452D35E8C2891017F08C759CA281FD99FC
- Validity: 2025-10-15 to 2027-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:91:af:12:ef:d9:4e:56:7e:e6:81:12:2c:2f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 15 03:10:54 2025 GMT
            Not After : Oct 15 00:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 OV TLS CA 2025 V2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:0C:50:EC:2C:95:AD:10:E8:F1:2A:90:37:DF:EF:1B:83:A6:6C:AE
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 96777B062F1A1CA0D6F5CDE31BB0012C303DEF52E4691D8D899F66560BCEA9B9
    SPKI SHA256: 00997DB8240CDB5FF2271EE595BC52452D35E8C2891017F08C759CA281FD99FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R6 SMIME CA 2023

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 SMIME CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7E87C3092ED766EF2F21E2A8D0A798F4
- SHA-256: 36D7314848ACCB3E4C5792D1B07120B1035BFB8B67E6600952D6745F5D6E22BD
- SPKI SHA-256: 6A32F6FCD0AAED0A7C53696436004F72F5040B026528EF29D4C87561A49DF2EC
- Validity: 2023-04-19 to 2029-04-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsgccr6smimeca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:87:c3:09:2e:d7:66:ef:2f:21:e2:a8:d0:a7:98:f4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 19 03:53:53 2023 GMT
            Not After : Apr 19 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 SMIME CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                00:29:36:9E:5C:7A:BA:0F:AF:2D:50:2D:DB:A0:23:85:18:B0:A0:92
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 36D7314848ACCB3E4C5792D1B07120B1035BFB8B67E6600952D6745F5D6E22BD
    SPKI SHA256: 6A32F6FCD0AAED0A7C53696436004F72F5040B026528EF29D4C87561A49DF2EC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign GCC R6 SMIME CA 2024

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign GCC R6 SMIME CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 814E420C5422FEF33A9CAF7C90DF2B51
- SHA-256: 12C3BABB3D477F7AF620BE1943570D1CF88362A485E7BE302C5ED58912E76E53
- SPKI SHA-256: 07246468448E86A3BD3D4A6659A9E018F477519AAA94DC8D45F902722FAB8A06
- Validity: 2024-06-19 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:42:0c:54:22:fe:f3:3a:9c:af:7c:90:df:2b:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 19 03:25:02 2024 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign GCC R6 SMIME CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E2:95:0C:77:FF:C9:D6:1D:7B:10:96:59:90:83:92:FB:3B:4A:8B:9D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 12C3BABB3D477F7AF620BE1943570D1CF88362A485E7BE302C5ED58912E76E53
    SPKI SHA256: 07246468448E86A3BD3D4A6659A9E018F477519AAA94DC8D45F902722FAB8A06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign HV ECC DV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV ECC DV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F2279EBF4086959522393
- SHA-256: 4B0D1392D39157353207A64CCB14683DDE9D2CED1FB58B16E038BE5707C27813
- SPKI SHA-256: D1F9C11549B2FD506319AFCF83B90369744601EE2649AC7F3D9EFBBE1B7F4999
- Validity: 2018-11-21 to 2028-11-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:79:eb:f4:08:69:59:52:23:93
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign HV ECC DV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2B:6A:46:49:BE:68:76:90:9C:BE:47:9C:6C:10:48:B1:C2:BA:6D:B3
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4B0D1392D39157353207A64CCB14683DDE9D2CED1FB58B16E038BE5707C27813
    SPKI SHA256: D1F9C11549B2FD506319AFCF83B90369744601EE2649AC7F3D9EFBBE1B7F4999
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign HV RSA DV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV RSA DV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F224E59C4D16E6CF53163
- SHA-256: 54C37A8E853FD1D6378D378B939307EC321A31CC1A5A89E7180633BC13F18762
- SPKI SHA-256: E49F27D6227E689A1F1497774D07EF1B727F51D286F65159739285F7C69D2908
- Validity: 2018-11-21 to 2028-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:4e:59:c4:d1:6e:6c:f5:31:63
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign HV RSA DV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B2:31:7C:78:60:50:AA:F8:3C:F9:F4:8F:2D:45:3E:AC:A0:00:64:EE
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 54C37A8E853FD1D6378D378B939307EC321A31CC1A5A89E7180633BC13F18762
    SPKI SHA256: E49F27D6227E689A1F1497774D07EF1B727F51D286F65159739285F7C69D2908
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign HV S/MIME CA 1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign HV S/MIME CA 1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 481B6A0E6E0FFFBDFD44FAB0FF07
- SHA-256: 0F8EEFEC0D1FDBDA33BFEB41455110613CC5681E92B4BCB95610DA35FE1F3C66
- SPKI SHA-256: 4431ADA006E533DC9D7C7DCDE3B3D273E3ADE8F765C8BD34873EBBC71AF6E441
- Validity: 2016-06-15 to 2021-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:0e:6e:0f:ff:bd:fd:44:fa:b0:ff:07
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2021 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign HV S/MIME CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CB:38:12:B0:C7:99:C0:78:92:8C:B3:21:95:E6:F4:26:62:C0:E0:3F
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F8EEFEC0D1FDBDA33BFEB41455110613CC5681E92B4BCB95610DA35FE1F3C66
    SPKI SHA256: 4431ADA006E533DC9D7C7DCDE3B3D273E3ADE8F765C8BD34873EBBC71AF6E441
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Issuing CA for AATL Partners 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Issuing CA for AATL Partners 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign AATL Partners CA 2019
- Serial: 751E3F7B3F819B4CF9D64FEEE6B11636
- SHA-256: 67C46DC17762667844F1596089375FF45E05C2B316C89499F6E7FAB78C8F0379
- SPKI SHA-256: 1AC8F500EDDC6D6C7AD4D256F7742BE8C36B299AEC7FA47EEC181749717F8991
- Validity: 2019-07-16 to 2029-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/gsaatlpartnersca2019
- CRL DP: http://crl.globalsign.com/gsaatlpartnersca2019.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:7b:3f:81:9b:4c:f9:d6:4f:ee:e6:b1:16:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign AATL Partners CA 2019
        Validity
            Not Before: Jul 16 00:00:00 2019 GMT
            Not After : Apr 30 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Issuing CA for AATL Partners 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                59:2D:C1:59:B5:97:01:22:1B:FE:64:12:06:F2:BB:B7:E4:73:32:BC
            X509v3 Authority Key Identifier:
                2C:94:2C:D0:D0:8B:6D:7F:D8:52:BD:74:0A:A8:58:D8:65:42:FA:28
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/gsaatlpartnersca2019
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlpartnersca2019.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlpartnersca2019.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 67C46DC17762667844F1596089375FF45E05C2B316C89499F6E7FAB78C8F0379
    SPKI SHA256: 1AC8F500EDDC6D6C7AD4D256F7742BE8C36B299AEC7FA47EEC181749717F8991
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/gsaatlpartnersca2019
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlpartnersca2019.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlpartnersca2019.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign ObjectSign CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=ObjectSign CA, commonName=GlobalSign ObjectSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA
- Serial: 0400000000011E44A5ECBE
- SHA-256: 614299AAEA670071EA113D2B977BEC4714B0CC8B2B54EFE6625D2690F512F7D6
- SPKI SHA-256: 0FEC4DB8020CA6FDFDDCB494D1C442087F6F66C7926E7ADA9E8BAA5916ADB804
- Validity: 2004-01-22 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.50
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/primobject.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:ec:be
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Primary Object Publishing CA, CN = GlobalSign Primary Object Publishing CA
        Validity
            Not Before: Jan 22 10:00:00 2004 GMT
            Not After : Jan 27 11:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = ObjectSign CA, CN = GlobalSign ObjectSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D2:5B:F3:4B:26:4B:A5:B0:E7:5D:FD:56:7F:F6:F1:2E:38:4E:53:A0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                  CPS: http://www.globalsign.net/repository
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/primobject.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/PrimObject.crt
            Netscape Cert Type:
                Object Signing CA
            X509v3 Authority Key Identifier:
                15:51:79:1A:7C:0C:59:F9:DA:CD:D8:C4:3A:13:9A:C9:78:2D:7F:4D
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 614299AAEA670071EA113D2B977BEC4714B0CC8B2B54EFE6625D2690F512F7D6
    SPKI SHA256: 0FEC4DB8020CA6FDFDDCB494D1C442087F6F66C7926E7ADA9E8BAA5916ADB804
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.50
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/PrimObject.crt
- CRL Distribution Points: http://crl.globalsign.net/primobject.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign ObjectSign CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=ObjectSign CA, commonName=GlobalSign ObjectSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA
- Serial: 0400000000011E44A5EF10
- SHA-256: B1D28E9188A9A28A3856296F4A21AAB1E9A805AADCA03FF80C917A2D2A17BE8F
- SPKI SHA-256: 0FEC4DB8020CA6FDFDDCB494D1C442087F6F66C7926E7ADA9E8BAA5916ADB804
- Validity: 2004-01-22 to 2022-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.50
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/primobject.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:ef:10
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Primary Object Publishing CA, CN = GlobalSign Primary Object Publishing CA
        Validity
            Not Before: Jan 22 10:00:00 2004 GMT
            Not After : Jan 27 11:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = ObjectSign CA, CN = GlobalSign ObjectSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D2:5B:F3:4B:26:4B:A5:B0:E7:5D:FD:56:7F:F6:F1:2E:38:4E:53:A0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.50
                  CPS: http://www.globalsign.net/repository
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/primobject.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/PrimObject.crt
            Netscape Cert Type:
                Object Signing CA
            X509v3 Authority Key Identifier:
                15:51:79:1A:7C:0C:59:F9:DA:CD:D8:C4:3A:13:9A:C9:78:2D:7F:4D
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B1D28E9188A9A28A3856296F4A21AAB1E9A805AADCA03FF80C917A2D2A17BE8F
    SPKI SHA256: 0FEC4DB8020CA6FDFDDCB494D1C442087F6F66C7926E7ADA9E8BAA5916ADB804
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.50
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/PrimObject.crt
- CRL Distribution Points: http://crl.globalsign.net/primobject.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign Offline R45 Timestamping CA 2025

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Offline R45 Timestamping CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 83DA8637B79F0C840C947B840A52781F
- SHA-256: 52373A21B95B5E6DE12A2BCF0FFB7D6A633B4CAAD725F64F6236FBE989DBC29E
- SPKI SHA-256: E1BD80627D2BB6CC7D475F00356463890E0B0879BBBCFD74C83EF767E3027F11
- Validity: 2025-07-16 to 2041-07-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsoffliner45timestampca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Jul 16 03:05:04 2025 GMT
            Not After : Jul 16 00:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Offline R45 Timestamping CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:02:3B:01:31:0F:1E:74:77:C3:48:C8:C3:07:63:55:88:A5:3B:A2
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 52373A21B95B5E6DE12A2BCF0FFB7D6A633B4CAAD725F64F6236FBE989DBC29E
    SPKI SHA256: E1BD80627D2BB6CC7D475F00356463890E0B0879BBBCFD74C83EF767E3027F11
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Organization Validated CA - SHA256 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validated CA - SHA256 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D89F0985C5CCAD667094DC
- SHA-256: 1E1741A12EB8DA2BD76EA96C04F520359839710F620E80952F48DD0240A12CD8
- SPKI SHA-256: 4BB93017F512FAA08B007ED03DBE275FA32CF08FCD532D0657DFFEC1547141EE
- Validity: 2018-02-13 to 2028-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsovsha2g4r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:09:85:c5:cc:ad:66:70:94:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validated CA - SHA256 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                61:18:B3:5D:68:D4:9E:D9:2F:EB:51:5C:03:B7:0A:40:C6:EE:6D:B4
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1E1741A12EB8DA2BD76EA96C04F520359839710F620E80952F48DD0240A12CD8
    SPKI SHA256: 4BB93017F512FAA08B007ED03DBE275FA32CF08FCD532D0657DFFEC1547141EE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Organization Validated ECC CA - SHA256 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validated ECC CA - SHA256 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D89F4536D615E524EDA15D
- SHA-256: 65EEC0CC6C970CC1CD73659115DC8D904E6F12E6DC8FD4DDA39D54CB30224780
- SPKI SHA-256: E17BFD31F94006DEC869FFC28EE616055B6AFEE1B9C9925D437B395528C21A83
- Validity: 2018-02-13 to 2028-02-13
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsoveccg4r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:9f:45:36:d6:15:e5:24:ed:a1:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 13 00:00:00 2018 GMT
            Not After : Feb 13 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validated ECC CA - SHA256 - G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                39:CC:82:87:FD:9D:B1:FD:3E:9C:70:71:73:23:2C:83:2E:EE:45:0D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 65EEC0CC6C970CC1CD73659115DC8D904E6F12E6DC8FD4DDA39D54CB30224780
    SPKI SHA256: E17BFD31F94006DEC869FFC28EE616055B6AFEE1B9C9925D437B395528C21A83
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Organization Validation CA

- Subject: organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5F6E0
- SHA-256: 84D3226619A7C2584D49B2CC7465FA85902EFEE3A5E8F36B36EC70CE3EA4A09F
- SPKI SHA-256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
- Validity: 2007-04-11 to 2017-04-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:f6:e0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 11 12:00:00 2007 GMT
            Not After : Apr 11 12:00:00 2017 GMT
        Subject: OU = Organization Validation CA, O = GlobalSign, CN = GlobalSign Organization Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7D:6D:2A:EC:66:AB:A7:51:36:AB:02:69:F1:70:8F:C4:59:0B:9A:1F
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 84D3226619A7C2584D49B2CC7465FA85902EFEE3A5E8F36B36EC70CE3EA4A09F
    SPKI SHA256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Organization Validation CA

- Subject: organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5F52A
- SHA-256: C3B1B3684B48530109D2AA68B24F7029D0A9E7CA295412ABCD3DC20D3A462CDD
- SPKI SHA-256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
- Validity: 2007-04-11 to 2017-04-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:f5:2a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 11 12:00:00 2007 GMT
            Not After : Apr 11 12:00:00 2017 GMT
        Subject: OU = Organization Validation CA, O = GlobalSign, CN = GlobalSign Organization Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7D:6D:2A:EC:66:AB:A7:51:36:AB:02:69:F1:70:8F:C4:59:0B:9A:1F
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C3B1B3684B48530109D2AA68B24F7029D0A9E7CA295412ABCD3DC20D3A462CDD
    SPKI SHA256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Organization Validation CA

- Subject: organizationalUnitName=Organization Validation CA, organizationName=GlobalSign, commonName=GlobalSign Organization Validation CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 04000000000127FBF76BF2
- SHA-256: 3F386D0780CA2A05A2B7A8007AC3F71E983A796C5D1B08A7E379A6CB8D65CD40
- SPKI SHA-256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
- Validity: 2007-03-19 to 2017-04-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:f7:6b:f2
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 19 12:00:00 2007 GMT
            Not After : Apr 11 12:00:00 2017 GMT
        Subject: OU = Organization Validation CA, O = GlobalSign, CN = GlobalSign Organization Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7D:6D:2A:EC:66:AB:A7:51:36:AB:02:69:F1:70:8F:C4:59:0B:9A:1F
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3F386D0780CA2A05A2B7A8007AC3F71E983A796C5D1B08A7E379A6CB8D65CD40
    SPKI SHA256: 39F189EFDBDE6C745BD51EADA2BE4EB6B902D17701688C384C6DA8B036D1DBDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 1.3.6.1.4.1.4146.1.20
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Organization Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000013189E55BF4
- SHA-256: A6233ECB77053F72937E894372A601ED3ABEA90CC3B5D89512720BF3FFCBDC9D
- SPKI SHA-256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:e5:5b:f4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:46:B2:8D:C4:4B:74:1C:BB:ED:F5:73:B6:3A:B7:38:8F:75:9E:7E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A6233ECB77053F72937E894372A601ED3ABEA90CC3B5D89512720BF3FFCBDC9D
    SPKI SHA256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Organization Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE142F9
- SHA-256: 082B243047BF00F584401F538B504BAE9EC060E007FFF28B159C08417068654E
- SPKI SHA-256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:42:f9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:46:B2:8D:C4:4B:74:1C:BB:ED:F5:73:B6:3A:B7:38:8F:75:9E:7E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 082B243047BF00F584401F538B504BAE9EC060E007FFF28B159C08417068654E
    SPKI SHA256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Organization Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE1450C
- SHA-256: A66422C4E449D465CB023A7FC7633DE8ED1816985CA41093FC96B3663ED7A43B
- SPKI SHA-256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:45:0c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:46:B2:8D:C4:4B:74:1C:BB:ED:F5:73:B6:3A:B7:38:8F:75:9E:7E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A66422C4E449D465CB023A7FC7633DE8ED1816985CA41093FC96B3663ED7A43B
    SPKI SHA256: 3AAA93962BC8E2D693083244D68ABAD6D02C767490FF5DC86E9D10284D47EED7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Organization Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001444EF04247
- SHA-256: 74EF335E5E18788307FB9D89CB704BEC112ABD23487DBFF41C4DED5070F241D9
- SPKI SHA-256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
- Validity: 2014-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:42:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:DE:61:F1:BD:1C:16:29:53:1C:C0:CC:7D:3B:83:00:40:E6:1A:7C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74EF335E5E18788307FB9D89CB704BEC112ABD23487DBFF41C4DED5070F241D9
    SPKI SHA256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Organization Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48CA817963306B5534D119589D17
- SHA-256: 1C9737E968AD9DFF8D8D7FCF996A144BB97851A19011A0190C943CAE8D43CFE0
- SPKI SHA-256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
- Validity: 2016-10-14 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:ca:81:79:63:30:6b:55:34:d1:19:58:9d:17
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct 14 00:00:00 2016 GMT
            Not After : Feb 20 10:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:DE:61:F1:BD:1C:16:29:53:1C:C0:CC:7D:3B:83:00:40:E6:1A:7C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1C9737E968AD9DFF8D8D7FCF996A144BB97851A19011A0190C943CAE8D43CFE0
    SPKI SHA256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Organization Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C644C9
- SHA-256: 0B339212D7CFF17A2C59E35669B58E77350133750A78DA9404770EDD470DEF76
- SPKI SHA-256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:44:c9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:DE:61:F1:BD:1C:16:29:53:1C:C0:CC:7D:3B:83:00:40:E6:1A:7C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0B339212D7CFF17A2C59E35669B58E77350133750A78DA9404770EDD470DEF76
    SPKI SHA256: 21006734112216E863FBCC7A5FC5CB821D3557D21CE7F57721140B34515CEEFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Organization Validation CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Organization Validation CA - SHA256 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 4707B1019A0C57AD39B3E17DA9F9
- SHA-256: 699D54B7482A5D329331EA0415CC2EDCD60FDA01D19E71D054196BCE0677735C
- SPKI SHA-256: D7D7BD9716BAA2389D54FE5D55966E4E5E150CAEB61EDA88531F5A03829CDDAC
- Validity: 2015-09-04 to 2025-09-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsorganizationvalsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:07:b1:01:9a:0c:57:ad:39:b3:e1:7d:a9:f9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep  4 00:00:00 2015 GMT
            Not After : Sep  4 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                68:86:B8:7D:7A:D9:6D:49:6B:87:2F:18:8B:15:34:6C:D7:B4:7A:0E
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 699D54B7482A5D329331EA0415CC2EDCD60FDA01D19E71D054196BCE0677735C
    SPKI SHA256: D7D7BD9716BAA2389D54FE5D55966E4E5E150CAEB61EDA88531F5A03829CDDAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Partners Timestamping CA - SHA384 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Partners Timestamping CA - SHA384 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F157ED038CA385D7F3CE7
- SHA-256: 2A015531A5F3A4CE589BD853C71DD069587322F574D85C9C9B9F9DF8F86C075E
- SPKI SHA-256: 315DC8CAB90D14806FC7D3E8C0EA07BF605AAC0A99DD1B040901310CB0BC81D0
- Validity: 2018-08-15 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsptnstsacasha384g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:15:7e:d0:38:ca:38:5d:7f:3c:e7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 15 00:00:00 2018 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Partners Timestamping CA - SHA384 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                23:04:64:5A:26:2B:B8:52:B5:2E:53:EF:E9:5A:AA:84:D9:51:8D:7C
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2A015531A5F3A4CE589BD853C71DD069587322F574D85C9C9B9F9DF8F86C075E
    SPKI SHA256: 315DC8CAB90D14806FC7D3E8C0EA07BF605AAC0A99DD1B040901310CB0BC81D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Partners TSA CA for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Partners TSA CA for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01EE5F159A005781CEDF5B6A59
- SHA-256: 7E8F914119BB1090D6204908E5AE1F40BE24C1491CD7D5CFB6A93618CBC00FD9
- SPKI SHA-256: 1FDD8F2865E9B9F7F208A6F0046018E1EE1763DF7405BAAE25E359D3BDAC873C
- Validity: 2018-08-15 to 2034-12-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsptnstsacaaatlsha2g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:15:9a:00:57:81:ce:df:5b:6a:59
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Aug 15 00:00:00 2018 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Partners TSA CA for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                98:4B:18:36:AD:87:58:E9:1D:B9:79:90:9A:D5:60:BD:B5:D9:C4:2C
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7E8F914119BB1090D6204908E5AE1F40BE24C1491CD7D5CFB6A93618CBC00FD9
    SPKI SHA256: 1FDD8F2865E9B9F7F208A6F0046018E1EE1763DF7405BAAE25E359D3BDAC873C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign PersonalSign 1 CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE12CE1
- SHA-256: 13CBF88815EF41E879BEDCB8B68E75E8051AA62FCE6799EEA34BD33D343BB32C
- SPKI SHA-256: 39D0CFB95B96AEFF29CABDC74225B49946F4EC3D60E177F65769F202E05BB2F1
- Validity: 2011-04-13 to 2019-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:2c:e1
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 1 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EC:AC:98:CC:27:72:93:CF:56:32:CD:23:C7:9D:8D:45:85:F4:22:03
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 13CBF88815EF41E879BEDCB8B68E75E8051AA62FCE6799EEA34BD33D343BB32C
    SPKI SHA256: 39D0CFB95B96AEFF29CABDC74225B49946F4EC3D60E177F65769F202E05BB2F1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 1 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7653FE4253FC25B20B56E29B3E88B20D
- SHA-256: F068DEAA18CC02D5A8BE35CB8338327910291F6E62E7216A934764A1ABA4A800
- SPKI SHA-256: 611CA97474B446EE2021877EBF60AE979BD057287CB1E331549BCFAF6A8B24E0
- Validity: 2020-01-22 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:42:53:fc:25:b2:0b:56:e2:9b:3e:88:b2:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 1 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:14:6A:00:48:D0:40:24:98:72:CD:76:13:0C:59:9C:80:4A:D7:27
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F068DEAA18CC02D5A8BE35CB8338327910291F6E62E7216A934764A1ABA4A800
    SPKI SHA256: 611CA97474B446EE2021877EBF60AE979BD057287CB1E331549BCFAF6A8B24E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 1 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 47C30FFF8A619A37F5A82EF0B575
- SHA-256: 254BE91C1ABCB28DB5E4D675A29A1E788460B06591F1BA8497CBD17837E27ABE
- SPKI SHA-256: 611CA97474B446EE2021877EBF60AE979BD057287CB1E331549BCFAF6A8B24E0
- Validity: 2016-03-16 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:0f:ff:8a:61:9a:37:f5:a8:2e:f0:b5:75
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 16 00:00:00 2016 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 1 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:14:6A:00:48:D0:40:24:98:72:CD:76:13:0C:59:9C:80:4A:D7:27
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 254BE91C1ABCB28DB5E4D675A29A1E788460B06591F1BA8497CBD17837E27ABE
    SPKI SHA256: 611CA97474B446EE2021877EBF60AE979BD057287CB1E331549BCFAF6A8B24E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_cert_or_sub_ca_using_sha1: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 1 CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C62DA7
- SHA-256: AEBE4DE9974A870A47876451CA3054C3B3C1C9C82090CDFF1EFF1425F2795574
- SPKI SHA-256: D6447B12D459354C37E40EB090EA67A86DDFB13F08B6B2E0D13D2263D6C4F399
- Validity: 2011-08-02 to 2019-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:2d:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 1 CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FE:29:A9:B8:FF:9C:5B:C9:ED:42:D9:6E:77:D8:34:57:41:A7:6D:05
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AEBE4DE9974A870A47876451CA3054C3B3C1C9C82090CDFF1EFF1425F2795574
    SPKI SHA256: D6447B12D459354C37E40EB090EA67A86DDFB13F08B6B2E0D13D2263D6C4F399
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 1 CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 1 CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 481B6A08A24488D35C9B3DC9480D
- SHA-256: F5D2D2BA6817A7A9AA0E21354BBF0E6F95C5E287EE88CF2F279F0FFEC4EDAC15
- SPKI SHA-256: 88C7C51C6C9B5951F813F9B577B21EA298FB33FDE29675C600FE76DCACE21930
- Validity: 2016-06-15 to 2024-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:08:a2:44:88:d3:5c:9b:3d:c9:48:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 1 CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:27:C2:C2:A5:F7:1C:F8:02:7A:7A:64:AF:63:6F:32:D2:98:C2:B1
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F5D2D2BA6817A7A9AA0E21354BBF0E6F95C5E287EE88CF2F279F0FFEC4EDAC15
    SPKI SHA256: 88C7C51C6C9B5951F813F9B577B21EA298FB33FDE29675C600FE76DCACE21930
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE12F52
- SHA-256: CBE21D29171ABE3A64494981AF2824C077B0E43C93B29A6535AED3C7A5B0719D
- SPKI SHA-256: CA2D7E89F23F8A9B9D66B5DC839F713BFE2D954E1F4F4BB65B9B4CC0B862E643
- Validity: 2011-04-13 to 2019-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:2f:52
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:15:D2:6D:7C:2F:E7:31:9E:43:0A:06:A8:94:6C:2C:3B:C5:EE:65
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CBE21D29171ABE3A64494981AF2824C077B0E43C93B29A6535AED3C7A5B0719D
    SPKI SHA256: CA2D7E89F23F8A9B9D66B5DC839F713BFE2D954E1F4F4BB65B9B4CC0B862E643
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 2 CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13146
- SHA-256: 16EF3B95DA74A072C2E494E3387749AB07451ED972C02BB8F8CA33020CC89055
- SPKI SHA-256: CA2D7E89F23F8A9B9D66B5DC839F713BFE2D954E1F4F4BB65B9B4CC0B862E643
- Validity: 2011-04-13 to 2019-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:31:46
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:15:D2:6D:7C:2F:E7:31:9E:43:0A:06:A8:94:6C:2C:3B:C5:EE:65
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 16EF3B95DA74A072C2E494E3387749AB07451ED972C02BB8F8CA33020CC89055
    SPKI SHA256: CA2D7E89F23F8A9B9D66B5DC839F713BFE2D954E1F4F4BB65B9B4CC0B862E643
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 47C31000189DC0411C9F3E546841
- SHA-256: 64E71601F7050921DEE039C03493615E488F12FC3FCECBADF438AA467EE1D41A
- SPKI SHA-256: 5259FADBEF7EE56B77C669158EEEB666AC7555CA191FB3C22D7A714B407C2F89
- Validity: 2016-03-16 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:10:00:18:9d:c0:41:1c:9f:3e:54:68:41
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 16 00:00:00 2016 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                64:37:95:B7:81:44:E3:5A:9D:78:2C:B2:03:51:39:9D:BD:01:C9:51
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 64E71601F7050921DEE039C03493615E488F12FC3FCECBADF438AA467EE1D41A
    SPKI SHA256: 5259FADBEF7EE56B77C669158EEEB666AC7555CA191FB3C22D7A714B407C2F89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_cert_or_sub_ca_using_sha1: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7653FE462D4BDC126705F4FD3ECC29CA
- SHA-256: 925EE7D5A22AD7FBE9BAB54D7C8D0B9A74F7E35A8AF6AF645E2E8C3519A7092F
- SPKI SHA-256: 5259FADBEF7EE56B77C669158EEEB666AC7555CA191FB3C22D7A714B407C2F89
- Validity: 2020-01-22 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:46:2d:4b:dc:12:67:05:f4:fd:3e:cc:29:ca
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                64:37:95:B7:81:44:E3:5A:9D:78:2C:B2:03:51:39:9D:BD:01:C9:51
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 925EE7D5A22AD7FBE9BAB54D7C8D0B9A74F7E35A8AF6AF645E2E8C3519A7092F
    SPKI SHA256: 5259FADBEF7EE56B77C669158EEEB666AC7555CA191FB3C22D7A714B407C2F89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C63306
- SHA-256: C021E99BC4C86C35194B51A6731CB697AA0A2C0D332AB85DDE56F899910E3AA9
- SPKI SHA-256: 7E364A6BDCD945235347AEB4C336510E9F55411A8BF034E298617866EFCE3FCF
- Validity: 2011-08-02 to 2019-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:33:06
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:6C:57:44:9E:57:9F:7D:FD:68:39:CB:B9:F1:1A:E4:B9:76:50:38
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C021E99BC4C86C35194B51A6731CB697AA0A2C0D332AB85DDE56F899910E3AA9
    SPKI SHA256: 7E364A6BDCD945235347AEB4C336510E9F55411A8BF034E298617866EFCE3FCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C630C4
- SHA-256: 5C0CA03AAA04D2CEFD57DB1F3B17313B200562175871E0D75331C08E2A56430C
- SPKI SHA-256: 7E364A6BDCD945235347AEB4C336510E9F55411A8BF034E298617866EFCE3FCF
- Validity: 2011-08-02 to 2019-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:30:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:6C:57:44:9E:57:9F:7D:FD:68:39:CB:B9:F1:1A:E4:B9:76:50:38
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5C0CA03AAA04D2CEFD57DB1F3B17313B200562175871E0D75331C08E2A56430C
    SPKI SHA256: 7E364A6BDCD945235347AEB4C336510E9F55411A8BF034E298617866EFCE3FCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 2 CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 481B6A0913BD8024CA5D22F014F3
- SHA-256: B778748A792B8F91F04B01BAFC31A31ED7EF6A712AFF80B6610D9AADEE207ADF
- SPKI SHA-256: 9A85465DE2EEDF7675B10C95A2764344C8821A21B80B561724F663BAA69FD2F1
- Validity: 2016-06-15 to 2024-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:09:13:bd:80:24:ca:5d:22:f0:14:f3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                69:72:82:62:31:67:95:44:85:77:91:80:C4:04:36:49:9D:7B:0B:61
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B778748A792B8F91F04B01BAFC31A31ED7EF6A712AFF80B6610D9AADEE207ADF
    SPKI SHA256: 9A85465DE2EEDF7675B10C95A2764344C8821A21B80B561724F663BAA69FD2F1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 2 CA - SHA256 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 CA - SHA256 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 778E9A43C6328D4B211E05879C072999
- SHA-256: 27D6FDAF80297846DFEFF82E7F58B9A48AC9E3EE93A112B1BBE243EE1A97447C
- SPKI SHA-256: 4A89A3CB79502F77F8A5DC6DDFE99479B62E35125276192264E8963197DA1499
- Validity: 2020-05-20 to 2028-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:43:c6:32:8d:4b:21:1e:05:87:9c:07:29:99
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 CA - SHA256 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:A9:D2:3E:25:5C:A3:E7:65:08:F9:57:64:E4:59:AE:0B:52:57:4E
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 27D6FDAF80297846DFEFF82E7F58B9A48AC9E3EE93A112B1BBE243EE1A97447C
    SPKI SHA256: 4A89A3CB79502F77F8A5DC6DDFE99479B62E35125276192264E8963197DA1499
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Smartcard Login, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign 2 ECC CA SHA 384 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 ECC CA SHA 384 - G4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D8A4A0F8AF5CF70C2BFA66
- SHA-256: 46038F6326228CDB56619C52266613DA04C8CA499E0D03B0EDCFFC110D5CFC70
- SPKI SHA-256: 9676B91D9006B28700DCF8EEE73334E85F795F2C2D39AF8BC54E505200B7117F
- Validity: 2018-04-18 to 2028-04-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:a0:f8:af:5c:f7:0c:2b:fa:66
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Apr 18 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 ECC CA SHA 384 - G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7A:6D:BE:62:3F:A7:EB:3A:BC:D2:3D:D3:C1:BD:AD:A2:DC:4C:3C:26
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 46038F6326228CDB56619C52266613DA04C8CA499E0D03B0EDCFFC110D5CFC70
    SPKI SHA256: 9676B91D9006B28700DCF8EEE73334E85F795F2C2D39AF8BC54E505200B7117F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign 2 RSA CA SHA 384 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 2 RSA CA SHA 384 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E9D8A49B72B28DEB938E7CAA
- SHA-256: 5CDD809CF44F5F8665EAC15055504C5B06B787AC18294505BDBAB4A77E50D776
- SPKI SHA-256: AAB61863522055CF0FEB4E7B67EB10B6B57782C746EFB08EA71729939131B834
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:9b:72:b2:8d:eb:93:8e:7c:aa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Apr 18 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 2 RSA CA SHA 384 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C2:80:13:02:09:B8:8F:C8:EF:82:2D:95:A5:E7:88:34:7E:50:AA:90
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5CDD809CF44F5F8665EAC15055504C5B06B787AC18294505BDBAB4A77E50D776
    SPKI SHA256: AAB61863522055CF0FEB4E7B67EB10B6B57782C746EFB08EA71729939131B834
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, ipsec Internet Key Exchange
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign 3 CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE133B7
- SHA-256: 2A84A5798BFBDE54086F00BDB68B0519238EE7F4FA86D13382D9B38BB5DE27A9
- SPKI SHA-256: E04B8370052255B45B5BBFD667443D73039242E8AD52D5E9830B465CE65CAFF7
- Validity: 2011-04-13 to 2019-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:33:b7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 3 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:D5:B0:20:A8:89:4C:75:6B:B5:38:B1:37:E0:3A:FE:D7:87:A5:5E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2A84A5798BFBDE54086F00BDB68B0519238EE7F4FA86D13382D9B38BB5DE27A9
    SPKI SHA256: E04B8370052255B45B5BBFD667443D73039242E8AD52D5E9830B465CE65CAFF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 3 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 47C31000C04BFA8A2654B741EC2B
- SHA-256: C228D93DBE5536A120AC24ED934467BAD7292F8B7EB202634B17070A89C5FE9B
- SPKI SHA-256: E855D2CE77D66203F129CE966A147F97760D3428F3D6A19B2E9E016489C2029B
- Validity: 2016-03-16 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:10:00:c0:4b:fa:8a:26:54:b7:41:ec:2b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 16 00:00:00 2016 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 3 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E2:2A:F7:E1:56:13:9E:2F:91:C7:08:62:09:9E:C0:21:5F:BE:6E:53
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C228D93DBE5536A120AC24ED934467BAD7292F8B7EB202634B17070A89C5FE9B
    SPKI SHA256: E855D2CE77D66203F129CE966A147F97760D3428F3D6A19B2E9E016489C2029B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_cert_or_sub_ca_using_sha1: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 3 CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7653FE48E371F2655DF1630DC8EBF440
- SHA-256: B1FE3AEBF963A7880E74B0B0556681EA8B1CCCE3E69A7D3B10A68ACBE86E48A1
- SPKI SHA-256: E855D2CE77D66203F129CE966A147F97760D3428F3D6A19B2E9E016489C2029B
- Validity: 2020-01-22 to 2024-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:48:e3:71:f2:65:5d:f1:63:0d:c8:eb:f4:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 16 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 3 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E2:2A:F7:E1:56:13:9E:2F:91:C7:08:62:09:9E:C0:21:5F:BE:6E:53
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B1FE3AEBF963A7880E74B0B0556681EA8B1CCCE3E69A7D3B10A68ACBE86E48A1
    SPKI SHA256: E855D2CE77D66203F129CE966A147F97760D3428F3D6A19B2E9E016489C2029B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, ipsec Internet Key Exchange, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, 1.3.6.1.4.1.311.21.6, IPSec User
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign 3 CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C63613
- SHA-256: 3B20D64ED7D2F43031DEE1AE847A489B6F33F5A28DB7FA2B09B7AEF5F77CA14A
- SPKI SHA-256: CE775102806B0E2F0794750257FBA168B8CCABFD04300B052FDA721FB88E56E4
- Validity: 2011-08-02 to 2019-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:36:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2019 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 3 CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                40:16:A1:96:71:C1:62:88:64:07:F9:2B:79:A3:95:30:E5:3E:39:8F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B20D64ED7D2F43031DEE1AE847A489B6F33F5A28DB7FA2B09B7AEF5F77CA14A
    SPKI SHA256: CE775102806B0E2F0794750257FBA168B8CCABFD04300B052FDA721FB88E56E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign PersonalSign 3 CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign 3 CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 481B6A09801B74914555531CD42D
- SHA-256: 701B432AC0CDD4D9CF95B4B884C32BF5CCA90D44E0161ABD13B934D68E380472
- SPKI SHA-256: 4C1D641160052BF09345941A9F1CBB633B0405372A48AE3D0EA3168BC6F101E9
- Validity: 2016-06-15 to 2024-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:1b:6a:09:80:1b:74:91:45:55:53:1c:d4:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:00 2016 GMT
            Not After : Jun 15 00:00:00 2024 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign 3 CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:3E:1E:67:13:2B:ED:A3:56:1F:6C:AE:F0:E2:9B:98:A2:0F:69:45
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 701B432AC0CDD4D9CF95B4B884C32BF5CCA90D44E0161ABD13B934D68E380472
    SPKI SHA256: 4C1D641160052BF09345941A9F1CBB633B0405372A48AE3D0EA3168BC6F101E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign PersonalSign Class 1 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 1 CA, commonName=GlobalSign PersonalSign Class 1 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 1 CA, commonName=GlobalSign Primary Class 1 CA
- Serial: 0400000000011E44A5E5AA
- SHA-256: 969B06E642BDCE7C5E2CF18B2494E56F7A59B1C5966AB21017714FBD272CAFB2
- SPKI SHA-256: B637F5ED10C7E1A1342FBB492E7CDAEB846E3EFC2858A390672DFA1D6BEDD90E
- Validity: 2004-01-22 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/primclass1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:e5:aa
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Primary Class 1 CA, CN = GlobalSign Primary Class 1 CA
        Validity
            Not Before: Jan 22 10:00:00 2004 GMT
            Not After : Jan 27 11:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = PersonalSign Class 1 CA, CN = GlobalSign PersonalSign Class 1 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:75:EE:F1:23:BD:75:42:EA:B7:89:40:46:BD:92:D2:72:EB:C5:E8
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: http://www.globalsign.net/repository
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/primclass1.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/PrimClass1.crt
            Netscape Cert Type:
                SSL CA, S/MIME CA
            X509v3 Authority Key Identifier:
                FC:E0:66:F6:5A:35:99:EB:40:1E:D2:B8:1E:43:BC:98:8E:1F:8A:C3
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 969B06E642BDCE7C5E2CF18B2494E56F7A59B1C5966AB21017714FBD272CAFB2
    SPKI SHA256: B637F5ED10C7E1A1342FBB492E7CDAEB846E3EFC2858A390672DFA1D6BEDD90E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/PrimClass1.crt
- CRL Distribution Points: http://crl.globalsign.net/primclass1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign PersonalSign Class 2 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 2 CA, commonName=GlobalSign PersonalSign Class 2 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 2 CA, commonName=GlobalSign Primary Class 2 CA
- Serial: 0400000000011E44A5E82A
- SHA-256: 2960D917FCA880182787E0C541E2FA0A21E1C8535754C40427CC9FBE4819974C
- SPKI SHA-256: 0B6860D49BAD30633F82C9422FE2019824F000B684F912E892D0BDE21288FC13
- Validity: 2004-01-22 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/primclass2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:e8:2a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Primary Class 2 CA, CN = GlobalSign Primary Class 2 CA
        Validity
            Not Before: Jan 22 10:00:00 2004 GMT
            Not After : Jan 27 11:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = PersonalSign Class 2 CA, CN = GlobalSign PersonalSign Class 2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6D:C4:2B:C1:7D:85:10:A0:F9:13:16:0D:55:2B:03:BA:36:4C:21:31
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: http://www.globalsign.net/repository
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/primclass2.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/PrimClass2.crt
            Netscape Cert Type:
                SSL CA, S/MIME CA
            X509v3 Authority Key Identifier:
                7C:E7:B2:B1:2C:DE:B1:A7:6B:E9:76:0C:E1:A3:FD:4E:6C:C7:B9:F6
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2960D917FCA880182787E0C541E2FA0A21E1C8535754C40427CC9FBE4819974C
    SPKI SHA256: 0B6860D49BAD30633F82C9422FE2019824F000B684F912E892D0BDE21288FC13
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/PrimClass2.crt
- CRL Distribution Points: http://crl.globalsign.net/primclass2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign PersonalSign Class 3 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=PersonalSign Class 3 CA, commonName=GlobalSign PersonalSign Class 3 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 3 CA, commonName=GlobalSign Primary Class 3 CA
- Serial: 0400000000011E44A5EA6C
- SHA-256: 29B0CCC09BF855B6F8523CE18E7D50E60BD32160E7830FC4F4F1D63161EEBC56
- SPKI SHA-256: 1319BEDB18CE9331E0A8216FE30A0DA6A9D1492B09E9BD68AB85DE0273637926
- Validity: 2004-01-22 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/primclass3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:ea:6c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Primary Class 3 CA, CN = GlobalSign Primary Class 3 CA
        Validity
            Not Before: Jan 22 10:00:00 2004 GMT
            Not After : Jan 27 11:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = PersonalSign Class 3 CA, CN = GlobalSign PersonalSign Class 3 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                65:08:DA:4B:5A:06:76:BD:8A:3F:E0:E4:4E:E8:7D:CA:3F:B0:C4:A6
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: http://www.globalsign.net/repository
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/primclass3.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/PrimClass3.crt
            Netscape Cert Type:
                SSL CA, S/MIME CA
            X509v3 Authority Key Identifier:
                CC:36:CC:17:B4:45:91:2F:ED:CF:3B:30:48:77:FB:B5:14:99:BE:E3
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 29B0CCC09BF855B6F8523CE18E7D50E60BD32160E7830FC4F4F1D63161EEBC56
    SPKI SHA256: 1319BEDB18CE9331E0A8216FE30A0DA6A9D1492B09E9BD68AB85DE0273637926
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/PrimClass3.crt
- CRL Distribution Points: http://crl.globalsign.net/primclass3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GlobalSign PersonalSign Partners CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13B58
- SHA-256: 236B8FF6CB17718D9C92440BD92C692D17381993E579118343C0A55C8DBE6C1A
- SPKI SHA-256: 4E22CEBAA2956057D2ED1394C7CDADA618C48735B709F5282DE5E3EBBBAC11BE
- Validity: 2011-04-13 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:3b:58
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                C5:7D:DA:83:E5:47:57:AA:C5:77:12:A7:CE:D9:0A:07:41:67:DF:39
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 236B8FF6CB17718D9C92440BD92C692D17381993E579118343C0A55C8DBE6C1A
    SPKI SHA256: 4E22CEBAA2956057D2ED1394C7CDADA618C48735B709F5282DE5E3EBBBAC11BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign Partners CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13D6B
- SHA-256: B2ABB9076EF203ADCB56B0ACB40C275262C6CFE9B7A12ABEA7C8FA57773B0D0A
- SPKI SHA-256: 4E22CEBAA2956057D2ED1394C7CDADA618C48735B709F5282DE5E3EBBBAC11BE
- Validity: 2011-04-13 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:3d:6b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                C5:7D:DA:83:E5:47:57:AA:C5:77:12:A7:CE:D9:0A:07:41:67:DF:39
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B2ABB9076EF203ADCB56B0ACB40C275262C6CFE9B7A12ABEA7C8FA57773B0D0A
    SPKI SHA256: 4E22CEBAA2956057D2ED1394C7CDADA618C48735B709F5282DE5E3EBBBAC11BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign PersonalSign Partners CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C63E80
- SHA-256: 118262C2088EE1528E20D836D2070854707C0D8F8E80FBE396F9ECD4B9141B5B
- SPKI SHA-256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
- Validity: 2011-08-02 to 2029-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:3e:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Mar 29 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 118262C2088EE1528E20D836D2070854707C0D8F8E80FBE396F9ECD4B9141B5B
    SPKI SHA256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign Partners CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE3887984C7A47FE4B5FA61B3D43
- SHA-256: 4E707867946AC05343C6BA8FF121EA66A758037913257A8EE4974350D39A1034
- SPKI SHA-256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:38:87:98:4c:7a:47:fe:4b:5f:a6:1b:3d:43
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E707867946AC05343C6BA8FF121EA66A758037913257A8EE4974350D39A1034
    SPKI SHA256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign PersonalSign Partners CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C640B2
- SHA-256: C8F1D691B4152C26033C977FE77978D9C82143D46B243B9C9BA7228E000E15BB
- SPKI SHA-256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
- Validity: 2011-08-02 to 2029-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:40:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Mar 29 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8F1D691B4152C26033C977FE77978D9C82143D46B243B9C9BA7228E000E15BB
    SPKI SHA256: 1746D63DE90F202F7F9E4800243EC43DAC1D492601C3D06FDDF3467531F506B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign Primary Class 1 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 1 CA, commonName=GlobalSign Primary Class 1 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5DD0F
- SHA-256: 8439D15EB439BC112D1498040F670A4E8558E0A0C07C7E7E8ED4E2B33D27D406
- SPKI SHA-256: 5BF5A9E599D3B9CCD52C55FF27701EE44E524A8D5DE10D8CE78A012123A2B5B8
- Validity: 1999-01-27 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:dd:0f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 27 13:00:00 1999 GMT
            Not After : Jan 27 12:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Primary Class 1 CA, CN = GlobalSign Primary Class 1 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                FC:E0:66:F6:5A:35:99:EB:40:1E:D2:B8:1E:43:BC:98:8E:1F:8A:C3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8439D15EB439BC112D1498040F670A4E8558E0A0C07C7E7E8ED4E2B33D27D406
    SPKI SHA256: 5BF5A9E599D3B9CCD52C55FF27701EE44E524A8D5DE10D8CE78A012123A2B5B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Primary Class 2 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 2 CA, commonName=GlobalSign Primary Class 2 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5DF31
- SHA-256: 7DAF5AAE26CEA413A8E808FEA126DAA382E616186B0821F7774E5A2F527BEC5A
- SPKI SHA-256: 1590931C0215F3A54519C0C17AC543A5678E9BD1D210166888B9D142F10BC086
- Validity: 1999-01-28 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:df:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 28 13:00:00 1999 GMT
            Not After : Jan 27 12:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Primary Class 2 CA, CN = GlobalSign Primary Class 2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                7C:E7:B2:B1:2C:DE:B1:A7:6B:E9:76:0C:E1:A3:FD:4E:6C:C7:B9:F6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7DAF5AAE26CEA413A8E808FEA126DAA382E616186B0821F7774E5A2F527BEC5A
    SPKI SHA256: 1590931C0215F3A54519C0C17AC543A5678E9BD1D210166888B9D142F10BC086
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Primary Class 3 CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Class 3 CA, commonName=GlobalSign Primary Class 3 CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5E099
- SHA-256: 6E36EFD26A6BEC62AD5E7A2E4B0A2A4D0311D064A38710FFF6D1AC0B47508B97
- SPKI SHA-256: 139E9679042571D7838AEEA472C8702F3751503CA8AD9D09A9E65B3DA93B596C
- Validity: 1999-01-28 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:e0:99
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 28 13:00:00 1999 GMT
            Not After : Jan 27 12:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Primary Class 3 CA, CN = GlobalSign Primary Class 3 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                CC:36:CC:17:B4:45:91:2F:ED:CF:3B:30:48:77:FB:B5:14:99:BE:E3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6E36EFD26A6BEC62AD5E7A2E4B0A2A4D0311D064A38710FFF6D1AC0B47508B97
    SPKI SHA256: 139E9679042571D7838AEEA472C8702F3751503CA8AD9D09A9E65B3DA93B596C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Primary Object Publishing CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5E404
- SHA-256: 8B91BB76B41427C6373D49590B32ED4C703CD8B98E11E1790C7935C278FD67DA
- SPKI SHA-256: 0BE9C76D949067A62FA438317DF584A14F99552280A76B81A25125EF97477992
- Validity: 1999-01-28 to 2022-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:e4:04
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 28 13:00:00 1999 GMT
            Not After : Jan 27 12:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Primary Object Publishing CA, CN = GlobalSign Primary Object Publishing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                15:51:79:1A:7C:0C:59:F9:DA:CD:D8:C4:3A:13:9A:C9:78:2D:7F:4D
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8B91BB76B41427C6373D49590B32ED4C703CD8B98E11E1790C7935C278FD67DA
    SPKI SHA256: 0BE9C76D949067A62FA438317DF584A14F99552280A76B81A25125EF97477992
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Primary Object Publishing CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Primary Object Publishing CA, commonName=GlobalSign Primary Object Publishing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000011E44A5E24E
- SHA-256: 5B688FA3D8DFAE2177710AC0DFC5D94B10623AF05B1EC1DE173028A28C98E680
- SPKI SHA-256: 0BE9C76D949067A62FA438317DF584A14F99552280A76B81A25125EF97477992
- Validity: 1999-01-28 to 2017-01-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:a5:e2:4e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 28 13:00:00 1999 GMT
            Not After : Jan 27 12:00:00 2017 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Primary Object Publishing CA, CN = GlobalSign Primary Object Publishing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                15:51:79:1A:7C:0C:59:F9:DA:CD:D8:C4:3A:13:9A:C9:78:2D:7F:4D
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5B688FA3D8DFAE2177710AC0DFC5D94B10623AF05B1EC1DE173028A28C98E680
    SPKI SHA256: 0BE9C76D949067A62FA438317DF584A14F99552280A76B81A25125EF97477992
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Qualified Authentication CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Authentication CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 778E9A4D2F43704B33B4FFDCBAE187E7
- SHA-256: 61D152180C8BB668A37DE25F24641807443CBBD50C1BCFF3E07058162A264448
- SPKI SHA-256: 49AE886B3D677E1D989C58798A3D3487DE14B430064D0E3D96718972D79B3F9C
- Validity: 2020-05-20 to 2026-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:4d:2f:43:70:4b:33:b4:ff:dc:ba:e1:87:e7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Authentication CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0E:76:C5:70:0D:00:CB:A9:7D:ED:E4:0C:DD:0D:78:05:16:F8:AF:71
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.39
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 61D152180C8BB668A37DE25F24641807443CBBD50C1BCFF3E07058162A264448
    SPKI SHA256: 49AE886B3D677E1D989C58798A3D3487DE14B430064D0E3D96718972D79B3F9C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Qualified Authentication ECC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Authentication ECC CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root E45
- Serial: 778E9A4FDC2DE7C89F0B2595D9A87C76
- SHA-256: 110CFA9601734984AB975D1069C6E45983E8AC1B9074FD489BAC2E2EFDF140E2
- SPKI SHA-256: 2CED72EB9AC6A7ACD7D962253B472BBFC2D24D8AEB8CF775C070F7BE41F1917A
- Validity: 2020-05-20 to 2030-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- CRL DP: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:4f:dc:2d:e7:c8:9f:0b:25:95:d9:a8:7c:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root E45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Authentication ECC CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B0:66:84:F4:1E:02:29:25:A8:9E:E1:F0:DF:3F:B0:55:2A:5E:32:74
            X509v3 Authority Key Identifier:
                B5:83:D6:70:06:8A:C6:9D:86:82:77:D5:A9:05:65:36:13:F1:C6:48
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.39
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 110CFA9601734984AB975D1069C6E45983E8AC1B9074FD489BAC2E2EFDF140E2
    SPKI SHA256: 2CED72EB9AC6A7ACD7D962253B472BBFC2D24D8AEB8CF775C070F7BE41F1917A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.39, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp.globalsign.com/clientauthroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified CA 1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01EC1C91FA33DAF135C0F7AB3C
- SHA-256: F5709A2D2F68B53BF6F645BB178ADF95346F89FDA5C63BFDE08042A26492AAB2
- SPKI SHA-256: 24B4A489234FBDA5FCFCD83612AD7BB5025C029D8FE8F9CCD81F8E8F2A3C9D88
- Validity: 2018-06-06 to 2028-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:91:fa:33:da:f1:35:c0:f7:ab:3c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Jun  6 00:00:00 2018 GMT
            Not After : Jun  6 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:37:DB:CF:32:C9:21:16:AA:0B:1C:06:03:86:F0:5D:C7:69:CD:1A
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.40.35
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F5709A2D2F68B53BF6F645BB178ADF95346F89FDA5C63BFDE08042A26492AAB2
    SPKI SHA256: 24B4A489234FBDA5FCFCD83612AD7BB5025C029D8FE8F9CCD81F8E8F2A3C9D88
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified CA 2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01EC1C92158C5E1EE69B82671A
- SHA-256: FD3A0F3DD4480092B6D450473DEB9201A0B308A8807833A3C738F8A07EB81ED3
- SPKI SHA-256: EA04CD147970B24A17BFFDC10BB506FC2125CA1CB3FABDF2A11383E453C690AD
- Validity: 2018-06-06 to 2028-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:92:15:8c:5e:1e:e6:9b:82:67:1a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Jun  6 00:00:00 2018 GMT
            Not After : Jun  6 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:43:71:1E:BB:F9:22:BC:AC:3A:36:15:D5:B2:8E:37:54:95:B9:16
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.40.35
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FD3A0F3DD4480092B6D450473DEB9201A0B308A8807833A3C738F8A07EB81ED3
    SPKI SHA256: EA04CD147970B24A17BFFDC10BB506FC2125CA1CB3FABDF2A11383E453C690AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified CA 3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified CA 3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01EC1C92154EFDEC7D4F8433B1
- SHA-256: 0AA9F2E7D95C718B7D1EB7CCDBD0164E86057AE9D66922BC60F9903F94A0F0EF
- SPKI SHA-256: 26AD503A4FACA0A1959A86C9BB9DEDC7715F8D20E9512F3EE891CC2118937F26
- Validity: 2018-06-06 to 2028-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:92:15:4e:fd:ec:7d:4f:84:33:b1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Jun  6 00:00:00 2018 GMT
            Not After : Jun  6 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified CA 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A7:D2:4C:1E:F6:E6:B7:B8:6D:14:23:AE:E8:1C:AA:78:42:6A:89:D5
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.40.35
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0AA9F2E7D95C718B7D1EB7CCDBD0164E86057AE9D66922BC60F9903F94A0F0EF
    SPKI SHA256: 26AD503A4FACA0A1959A86C9BB9DEDC7715F8D20E9512F3EE891CC2118937F26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.40.35
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified QSCD Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified QSCD Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 778E9A53830841A426630541CB387AD7
- SHA-256: BAB082319000C0C103185D75135DA328ACA013E8F70F356833620D24800CD4C7
- SPKI SHA-256: 5E25DA18196C23C7B758DFFC35B491E36EA6F5330CF327578BFFD1FF2E81ADED
- Validity: 2020-05-20 to 2026-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:53:83:08:41:a4:26:63:05:41:cb:38:7a:d7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified QSCD Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9B:45:87:09:9C:CE:A2:B3:BC:4F:54:05:44:A8:FC:22:42:47:5A:A2
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.36
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: BAB082319000C0C103185D75135DA328ACA013E8F70F356833620D24800CD4C7
    SPKI SHA256: 5E25DA18196C23C7B758DFFC35B491E36EA6F5330CF327578BFFD1FF2E81ADED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Qualified QSCD Signing ECC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified QSCD Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 778E9A5753BADC911B0B9FDA2ED85747
- SHA-256: 5A65CA143019485BDD714A0285371C00426C0C67097C7939939E488819224A29
- SPKI SHA-256: 0253C1B3E056268BEE31BA9FF38C13D71C757253E87E1F27E8E6897E141D9F7D
- Validity: 2020-05-20 to 2030-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:57:53:ba:dc:91:1b:0b:9f:da:2e:d8:57:47
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified QSCD Signing ECC CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6F:18:A2:40:BB:28:D5:5F:0B:34:8C:89:91:98:21:35:FD:2B:49:28
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.36
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5A65CA143019485BDD714A0285371C00426C0C67097C7939939E488819224A29
    SPKI SHA256: 0253C1B3E056268BEE31BA9FF38C13D71C757253E87E1F27E8E6897E141D9F7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.36, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified Remote Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Remote Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 778E9A59856A263199E7956667493031
- SHA-256: 2ABF6447B72ECB572DA30B27CD8D2069033AF045714AC458DA0789E9623E260F
- SPKI SHA-256: 5BF26218154A6A87473A3FB9DC9533102B4A805173306FE8EDCEDFE07FFD4621
- Validity: 2020-05-20 to 2026-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:59:85:6a:26:31:99:e7:95:66:67:49:30:31
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Remote Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:8B:D2:85:D1:87:2D:75:B0:4E:83:FD:DE:61:F0:32:2C:98:57:63
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.38
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2ABF6447B72ECB572DA30B27CD8D2069033AF045714AC458DA0789E9623E260F
    SPKI SHA256: 5BF26218154A6A87473A3FB9DC9533102B4A805173306FE8EDCEDFE07FFD4621
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Qualified Remote Signing ECC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Remote Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 778E9A5E2C66526CD83F8003D156B184
- SHA-256: AEB217DC3CB735F7A4D17C4983D316153FA23960586F1E2F0BFDD9F60DA043FB
- SPKI SHA-256: A1ED5704D37B25A4C29CC52EB53C863833A7A189D5EDE6B2042691BAA0B6A2DF
- Validity: 2020-05-20 to 2030-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:5e:2c:66:52:6c:d8:3f:80:03:d1:56:b1:84
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Remote Signing ECC CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8B:4E:83:0D:50:33:85:98:51:70:60:2C:81:A7:EA:FC:03:32:64:73
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.38
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AEB217DC3CB735F7A4D17C4983D316153FA23960586F1E2F0BFDD9F60DA043FB
    SPKI SHA256: A1ED5704D37B25A4C29CC52EB53C863833A7A189D5EDE6B2042691BAA0B6A2DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.38, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified Signing CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Signing CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 778E9A4799FE5F2F6EEB3E69C78F33F3
- SHA-256: A686AD3494BEB5ADC479C280BF156D3F87109F7866F88511E93D753EA3DD55E9
- SPKI SHA-256: 5F16428769008F964F2C70AA3111BC4E4CB06A7062E674A0D809F454A825EA5A
- Validity: 2020-05-20 to 2026-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:47:99:fe:5f:2f:6e:eb:3e:69:c7:8f:33:f3
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Signing CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8D:D8:F7:12:6F:6B:EA:A4:A8:84:A8:AF:46:58:F5:C2:45:69:03:D2
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.37
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: A686AD3494BEB5ADC479C280BF156D3F87109F7866F88511E93D753EA3DD55E9
    SPKI SHA256: 5F16428769008F964F2C70AA3111BC4E4CB06A7062E674A0D809F454A825EA5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Qualified Signing ECC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Signing ECC CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 778E9A4A04869D498CFA8BC546A9D4FF
- SHA-256: 11476A7C474022CC44D3E5D5952B587A7D940D25EA7EA959FE640B2CA9F7BFF9
- SPKI SHA-256: 55DAB8787D212119B919DC23A2AAE01C8DA4D99A2E7EA145980803B6B9965123
- Validity: 2020-05-20 to 2030-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:4a:04:86:9d:49:8c:fa:8b:c5:46:a9:d4:ff
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Signing ECC CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0B:C7:BA:39:DF:4B:26:1C:0F:43:3D:B6:72:44:92:1D:16:CE:BE:6B
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.37
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 11476A7C474022CC44D3E5D5952B587A7D940D25EA7EA959FE640B2CA9F7BFF9
    SPKI SHA256: 55DAB8787D212119B919DC23A2AAE01C8DA4D99A2E7EA145980803B6B9965123
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.37, 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Qualified Time Stamping CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Time Stamping CA 2019
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3F3E0D16E07C360DA0ADD169A915
- SHA-256: 74ABE5E5CCEB75491FF72C4CF325405D8ADBFE390E189CF430BA60E62798878E
- SPKI SHA-256: C1AF48C11DCA2964727CCB52EF736DD6151697ADD08F73DF83A543551DA16597
- Validity: 2019-05-15 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsqtsca2019.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:3e:0d:16:e0:7c:36:0d:a0:ad:d1:69:a9:15
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Time Stamping CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                71:4B:5C:AC:76:E2:A1:4D:E1:B3:E9:8C:F2:C2:F9:B7:B0:07:40:D3
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.32
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 74ABE5E5CCEB75491FF72C4CF325405D8ADBFE390E189CF430BA60E62798878E
    SPKI SHA256: C1AF48C11DCA2964727CCB52EF736DD6151697ADD08F73DF83A543551DA16597
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Qualified Timestamping CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Timestamping CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 778E9A5F8DF8CBE6B40704CCAB67CF51
- SHA-256: FD8B39230117A7E4D060E39489F4FE30662BAFE624A29E43B133615BABC63C20
- SPKI SHA-256: 0F334DFA3765D9527AF2737E967847194242B7F35107CCD6C69358BAFB9B2AE9
- Validity: 2020-05-20 to 2026-05-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:5f:8d:f8:cb:e6:b4:07:04:cc:ab:67:cf:51
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2026 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Timestamping CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A0:1E:03:10:E2:06:F4:D4:57:7C:3F:28:29:96:CB:36:9E:49:33:48
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.32
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: FD8B39230117A7E4D060E39489F4FE30662BAFE624A29E43B133615BABC63C20
    SPKI SHA256: 0F334DFA3765D9527AF2737E967847194242B7F35107CCD6C69358BAFB9B2AE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign Qualified Timestamping ECC CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Qualified Timestamping ECC CA 2020, organizationIdentifier=NTRBE-0459134256
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 778E9A6256ED138E52C4B5B2C47174F8
- SHA-256: C2FEACD674878C7B0C2325A2ECED0A333DB7780A86DFEC3758100EFC0101C665
- SPKI SHA-256: BD06FD3338AE611DC9C2C59483B5C86B5D588D4B4E167C3E156384E68ABDE6E1
- Validity: 2020-05-20 to 2035-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:8e:9a:62:56:ed:13:8e:52:c4:b5:b2:c4:71:74:f8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 20 00:00:00 2020 GMT
            Not After : May 20 00:00:00 2035 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Qualified Timestamping ECC CA 2020, organizationIdentifier = NTRBE-0459134256
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                85:A0:9D:62:2D:A1:1D:77:5A:D4:C7:4D:7F:93:A5:D1:BA:2E:E3:48
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.32
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.95
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C2FEACD674878C7B0C2325A2ECED0A333DB7780A86DFEC3758100EFC0101C665
    SPKI SHA256: BD06FD3338AE611DC9C2C59483B5C86B5D588D4B4E167C3E156384E68ABDE6E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.32, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign R45 AATL Root CA 2020

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Root CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 78031880DEA16AAEB170F1D6D55E82B7
- SHA-256: B296DC3BCF451217D7AD4F84FB8EE25CC92FC659CAFA0EB4A8B5B4DB3D0215C2
- SPKI SHA-256: 618C2DFF07AE209FD79C06562F8A987A8ABA84BF80D73E5B08D5ADA153F73A89
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsr45aatlrootca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:80:de:a1:6a:ae:b1:70:f1:d6:d5:5e:82:b7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Root CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B4:FD:37:DC:61:80:75:B5:F5:71:96:21:B3:17:10:08:C6:46:BC:C2
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B296DC3BCF451217D7AD4F84FB8EE25CC92FC659CAFA0EB4A8B5B4DB3D0215C2
    SPKI SHA256: 618C2DFF07AE209FD79C06562F8A987A8ABA84BF80D73E5B08D5ADA153F73A89
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign R45 AATL TimeStamping Root CA 2021

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL TimeStamping Root CA 2021
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 79B9FF732FA94394A7DA59F50ACBD59A
- SHA-256: 3A6224E6EF98D0C4770C229E89CFA346623DF5A250D4B68D04CD5DA4BD85C4CE
- SPKI SHA-256: 291B26B73E5CA627DE8C9B4122058DE681D1618C0379E0B5950D2B6123B81703
- Validity: 2021-05-19 to 2038-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gsr45aatltimestampingrootca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:ff:73:2f:a9:43:94:a7:da:59:f5:0a:cb:d5:9a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: May 19 00:00:00 2021 GMT
            Not After : May 18 23:59:59 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL TimeStamping Root CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C8:D8:D3:EE:C3:A2:9A:0B:C6:74:29:3B:A4:A2:6D:E7:8F:EA:E5:C5
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.31
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3A6224E6EF98D0C4770C229E89CFA346623DF5A250D4B68D04CD5DA4BD85C4CE
    SPKI SHA256: 291B26B73E5CA627DE8C9B4122058DE681D1618C0379E0B5950D2B6123B81703
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign R45 AATL TimeStamping Trusted CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL TimeStamping Trusted CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Serial: 86154A2C9700310B3BBEB49E28B6A47B
- SHA-256: 05BC48F8B0B839696395EF7B17F2DC8BB047B3AA83AAA339B331C72DB74E14C1
- SPKI SHA-256: 351131869AB31FF7FFC485DCAC3971D48A967AB9C4DAC33D905BFD156B5579B7
- Validity: 2026-06-24 to 2044-06-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- CRL DP: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:15:4a:2c:97:00:31:0b:3b:be:b4:9e:28:b6:a4:7b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Validity
            Not Before: Jun 24 03:15:41 2026 GMT
            Not After : Jun 23 12:00:00 2044 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL TimeStamping Trusted CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:CA:06:7F:32:EC:01:DB:77:C4:5A:A4:F8:84:CC:95:CC:00:EC:F7
            X509v3 Authority Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/timestamprootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/timestamprootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/timestamprootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.31
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 05BC48F8B0B839696395EF7B17F2DC8BB047B3AA83AAA339B331C72DB74E14C1
    SPKI SHA256: 351131869AB31FF7FFC485DCAC3971D48A967AB9C4DAC33D905BFD156B5579B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.4146.1.31
- AIA OCSP: http://ocsp.globalsign.com/timestamprootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/timestamprootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/timestamprootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign R45 AATL Trusted CA 2026

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R45 AATL Trusted CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root R45
- Serial: 86154A0C8AD1F0C3A2B7974BBEEBCBF4
- SHA-256: B123123C473B67ABAABA4A91D27A6336DAF3100F91CAB31FC4DF29DFE2365FF5
- SPKI SHA-256: C9EF3920F005600E3982199500243335C03F2A061AA25DED50139E17FA5F74BE
- Validity: 2026-06-24 to 2041-06-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- CRL DP: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:15:4a:0c:8a:d1:f0:c3:a2:b7:97:4b:be:eb:cb:f4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root R45
        Validity
            Not Before: Jun 24 03:15:15 2026 GMT
            Not After : Jun 23 12:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R45 AATL Trusted CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                CB:1F:C5:15:82:36:0C:A6:52:B9:92:2A:2C:F2:B6:99:41:C7:2E:68
            X509v3 Authority Key Identifier:
                07:41:57:4B:CF:E1:1C:16:53:D5:BD:EB:83:6C:CC:8B:29:21:84:BF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B123123C473B67ABAABA4A91D27A6336DAF3100F91CAB31FC4DF29DFE2365FF5
    SPKI SHA256: C9EF3920F005600E3982199500243335C03F2A061AA25DED50139E17FA5F74BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30
- AIA OCSP: http://ocsp.globalsign.com/docsignrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign R6 Admin CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R6 Admin CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48A402DDB5DEFD50ACCFC0FCF13F
- SHA-256: C5B679106958152F83FB5886DDC41F0785193EF67C6975BE3E509F17F29B7A86
- SPKI SHA-256: D93B81202B308978A9B2F41697E536A18EF7DA09F4ACE9376EA50E3779DB0F92
- Validity: 2016-09-21 to 2021-09-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:a4:02:dd:b5:de:fd:50:ac:cf:c0:fc:f1:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 21 00:00:00 2016 GMT
            Not After : Sep 21 00:00:00 2021 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R6 Admin CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:49:5C:E9:05:BF:0C:88:A0:38:96:B2:5D:41:03:5A:E9:FF:D7:87
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C5B679106958152F83FB5886DDC41F0785193EF67C6975BE3E509F17F29B7A86
    SPKI SHA256: D93B81202B308978A9B2F41697E536A18EF7DA09F4ACE9376EA50E3779DB0F92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GlobalSign R6 RSA EV SSL CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign R6 RSA EV SSL CA 2019
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3EE8F0EED3FB49BC1D2DFAAD938F
- SHA-256: 57264B82A864DBA1C11EF3F80ABB94CAC3660662B0C22F571FF993B3FBCF76FB
- SPKI SHA-256: 40EA253D1F38E470BC15FE3CE79B8B7495232E2A1AA56F28483E8CFF220C1700
- Validity: 2019-05-15 to 2029-05-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3e:e8:f0:ee:d3:fb:49:bc:1d:2d:fa:ad:93:8f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : May 15 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign R6 RSA EV SSL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:3C:67:3C:93:76:0E:38:A5:B1:CE:F4:45:9D:0F:60:AA:16:AF:0A
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 57264B82A864DBA1C11EF3F80ABB94CAC3660662B0C22F571FF993B3FBCF76FB
    SPKI SHA256: 40EA253D1F38E470BC15FE3CE79B8B7495232E2A1AA56F28483E8CFF220C1700
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 75A8BAD573A52075D2904A2101AED560
- SHA-256: 0F1554C2FD591B0256A608E1C136A837E7A6E041561EE08A911B2AFDCD3C6C1B
- SPKI SHA-256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
- Validity: 2019-11-20 to 2038-01-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/roote46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:d5:73:a5:20:75:d2:90:4a:21:01:ae:d5:60
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Jan 19 00:00:00 2038 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0F1554C2FD591B0256A608E1C136A837E7A6E041561EE08A911B2AFDCD3C6C1B
    SPKI SHA256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 75A8BAD30D98D4B28B9B7EE852D248A9
- SHA-256: 33EF151EFB08D1C44FB85CC3F23EC6873014E9F881691BD4938B7F251580B694
- SPKI SHA-256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
- Validity: 2019-11-20 to 2028-01-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/roote46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:d3:0d:98:d4:b2:8b:9b:7e:e8:52:d2:48:a9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Jan 28 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 33EF151EFB08D1C44FB85CC3F23EC6873014E9F881691BD4938B7F251580B694
    SPKI SHA256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 75A8BADA4FDF4482FA33C4F0F394F84B
- SHA-256: 1DF6054D6641404633641BB5FA3742FDA7D075E2514840AB61E00CCBBB7D341D
- SPKI SHA-256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
- Validity: 2019-11-20 to 2029-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/roote46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:da:4f:df:44:82:fa:33:c4:f0:f3:94:f8:4b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1DF6054D6641404633641BB5FA3742FDA7D075E2514840AB61E00CCBBB7D341D
    SPKI SHA256: E04A022CE32F4CCF2C7F6046287B828A32A909F5E751447F83FD2C71F6FD8173
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root R46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 75A8BAD878F8AF305F72DD1C1140DF3A
- SHA-256: A63C1398B5F8DD2D432FBE4C2C19142BEA6D5D0221FAE794718AE7597ACCA96D
- SPKI SHA-256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
- Validity: 2019-11-20 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rootr46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:d8:78:f8:af:30:5f:72:dd:1c:11:40:df:3a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A63C1398B5F8DD2D432FBE4C2C19142BEA6D5D0221FAE794718AE7597ACCA96D
    SPKI SHA256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root R46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 75A8BAD9BE1CD99FCFE18BB4F0D44F19
- SHA-256: 45CB1D874CB03BD5C5B6E079C8FC29E51521EE5628486301964A41F94BA59F88
- SPKI SHA-256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
- Validity: 2019-11-20 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rootr46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:d9:be:1c:d9:9f:cf:e1:8b:b4:f0:d4:4f:19
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 45CB1D874CB03BD5C5B6E079C8FC29E51521EE5628486301964A41F94BA59F88
    SPKI SHA256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Root R46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 75A8BAD68321350B5B0BAC34E1CE389F
- SHA-256: A5E33C28E3013A71F5F760AE3B16595090043D2EC5209EC52903C4FBAD258DAD
- SPKI SHA-256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
- Validity: 2019-11-20 to 2028-01-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rootr46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:d6:83:21:35:0b:5b:0b:ac:34:e1:ce:38:9f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Nov 20 00:00:00 2019 GMT
            Not After : Jan 28 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A5E33C28E3013A71F5F760AE3B16595090043D2EC5209EC52903C4FBAD258DAD
    SPKI SHA256: AE7F962CB9E6A7DBF7B833FB18FA9B71A89175DF949C232B6A9EF7CB3DF2BBFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign RootSign Partners CA

- Subject: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 040000000001154B5AC5A7
- SHA-256: 20BBB89108079E0701D86B8A893A2A9546E698FECBB70A567A41253887E5724A
- SPKI SHA-256: 0B1EDD5F16124A9B948C6A469540EEF5824E4B22FE0F3A6CC7C1781D2A73A8B8
- Validity: 2003-12-16 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:15:4b:5a:c5:a7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Dec 16 13:00:00 2003 GMT
            Not After : Jan 28 11:00:00 2028 GMT
        Subject: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/Root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 20BBB89108079E0701D86B8A893A2A9546E698FECBB70A567A41253887E5724A
    SPKI SHA256: 0B1EDD5F16124A9B948C6A469540EEF5824E4B22FE0F3A6CC7C1781D2A73A8B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/Root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### GlobalSign RSA DV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA DV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F222DE71B43A5D4669F9E
- SHA-256: 9E898ED03FA46969690DAD73C7296675045FF9B5A0100A399BEB8435A98F5185
- SPKI SHA-256: CDFFA2FDF6AC5B800B7BA3CCF5716646D28DFC7142A5A9A5AB614AF33FD5BAFB
- Validity: 2018-11-21 to 2028-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:2d:e7:1b:43:a5:d4:66:9f:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA DV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:80:D6:28:79:35:4A:5B:79:35:89:39:8F:12:17:6E:11:7B:2C:11
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9E898ED03FA46969690DAD73C7296675045FF9B5A0100A399BEB8435A98F5185
    SPKI SHA256: CDFFA2FDF6AC5B800B7BA3CCF5716646D28DFC7142A5A9A5AB614AF33FD5BAFB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign RSA EV QWAC CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA EV QWAC CA 2019
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 751E3F3DE96CD728B26662C55232587B
- SHA-256: EDC734C501501DC7A27448FA02C74931F8578BF297B173F34B841E82C6691926
- SPKI SHA-256: B07B38279911CD2A4E47C078C3986359A0CFA9F78EFDBEC7940C93F9CA286A9A
- Validity: 2019-05-15 to 2028-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:3d:e9:6c:d7:28:b2:66:62:c5:52:32:58:7b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : May 15 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA EV QWAC CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                52:8F:AA:5A:B3:AB:72:EE:DD:C9:F9:91:A1:C9:B9:06:12:D2:04:DD
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EDC734C501501DC7A27448FA02C74931F8578BF297B173F34B841E82C6691926
    SPKI SHA256: B07B38279911CD2A4E47C078C3986359A0CFA9F78EFDBEC7940C93F9CA286A9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign RSA EV SSL CA 2019

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA EV SSL CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 11D71C22DA2DE4EFD94349A240DF68A54ECD
- SHA-256: 0D6E46784F3B694E9C7506786417BC6F87F9D2F73D19B5E8081612B21137B766
- SPKI SHA-256: CD086C23859E1760F99CF25A220516A6A31E11F1721F1D8F647590918A9114CA
- Validity: 2019-04-10 to 2029-04-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:d7:1c:22:da:2d:e4:ef:d9:43:49:a2:40:df:68:a5:4e:cd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Apr 10 00:00:00 2019 GMT
            Not After : Apr 10 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA EV SSL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BC:F4:83:6B:6A:53:6C:17:05:BD:D4:BF:0C:B3:16:F1:0F:63:C5:DF
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0D6E46784F3B694E9C7506786417BC6F87F9D2F73D19B5E8081612B21137B766
    SPKI SHA256: CD086C23859E1760F99CF25A220516A6A31E11F1721F1D8F647590918A9114CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign RSA OV SSL CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign RSA OV SSL CA 2018
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EE5F221DFC623BD4333A8557
- SHA-256: B676FFA3179E8812093A1B5EAFEE876AE7A6AAF231078DAD1BFB21CD2893764A
- SPKI SHA-256: 8444E9815BDA2C2D1BBDC186DEDD1CBAA887BEBE17C8FD8C4F00A2AA18115B05
- Validity: 2018-11-21 to 2028-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gsrsaovsslca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:22:1d:fc:62:3b:d4:33:3a:85:57
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 21 00:00:00 2018 GMT
            Not After : Nov 21 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F8:EF:7F:F2:CD:78:67:A8:DE:6F:8F:24:8D:88:F1:87:03:02:B3:EB
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B676FFA3179E8812093A1B5EAFEE876AE7A6AAF231078DAD1BFB21CD2893764A
    SPKI SHA256: 8444E9815BDA2C2D1BBDC186DEDD1CBAA887BEBE17C8FD8C4F00A2AA18115B05
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Secure Mail Root E45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root E45
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803183C654FD1D473CC7E1E468A51CF
- SHA-256: 5B87841E80AAFE877804E56694473DCA8BB9F1FF4FFCF885A3DAFD24463FCB64
- SPKI SHA-256: 35FF6B4F5DA2910F8E7E6D583400ED8C7CE6FC85924E25D74EBD27C31EE7AC0B
- Validity: 2020-07-28 to 2037-07-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/smimeroote45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:3c:65:4f:d1:d4:73:cc:7e:1e:46:8a:51:cf
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2037 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root E45
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DF:13:5E:8B:5F:C2:40:02:FD:56:B7:94:4C:B6:1E:D5:A6:B1:14:96
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5B87841E80AAFE877804E56694473DCA8BB9F1FF4FFCF885A3DAFD24463FCB64
    SPKI SHA256: 35FF6B4F5DA2910F8E7E6D583400ED8C7CE6FC85924E25D74EBD27C31EE7AC0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Secure Mail Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7803183DFE58D0CEDA4DB4E514F40796
- SHA-256: 5268C94573AF66BA5A3DE979F2048DE43BD4B68AF0B73A2D639159FAFE637F69
- SPKI SHA-256: 321638C3101B3FFC36F280F0963185FC16D313F2A92CABED2BC1FA16FB1CAA31
- Validity: 2020-07-28 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/smimerootr45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:3d:fe:58:d0:ce:da:4d:b4:e5:14:f4:07:96
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5268C94573AF66BA5A3DE979F2048DE43BD4B68AF0B73A2D639159FAFE637F69
    SPKI SHA256: 321638C3101B3FFC36F280F0963185FC16D313F2A92CABED2BC1FA16FB1CAA31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign SMIME CA 2018

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign SMIME CA 2018
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EC1C924B55E05E90EEC02D18
- SHA-256: C8192C32F7B49C7F32A1CA001595A7F9E36C9E72058D6EAA1BAB7752A8C16718
- SPKI SHA-256: E4C1139A8E9153B9121451DAB32F3BF98AFECD1DE9158E86342635334F38AA98
- Validity: 2018-06-20 to 2028-06-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:92:4b:55:e0:5e:90:ee:c0:2d:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 20 00:00:00 2018 GMT
            Not After : Jun 20 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign SMIME CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:B7:05:89:D6:53:CD:23:40:A2:E8:0F:78:1A:E4:6D:5C:4C:EC:D2
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                Policy: 1.3.6.1.4.1.4146.1.40.10
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8192C32F7B49C7F32A1CA001595A7F9E36C9E72058D6EAA1BAB7752A8C16718
    SPKI SHA256: E4C1139A8E9153B9121451DAB32F3BF98AFECD1DE9158E86342635334F38AA98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.40, 1.3.6.1.4.1.4146.1.40.10, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Timestamping CA

- Subject: organizationalUnitName=Timestamping CA, organizationName=GlobalSign, commonName=GlobalSign Timestamping CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012019C19066
- SHA-256: D0CAE6947BC77F0B495CA808D6CDE685FCD20225E1E530B635B113ED40728EF3
- SPKI SHA-256: 709CB325047D99A8320F977D0B67CB1ABBBC02A8BE3E0B44403ED33360EAFAA2
- Validity: 2009-03-18 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.net/Timestamping1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:20:19:c1:90:66
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Mar 18 11:00:00 2009 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: OU = Timestamping CA, O = GlobalSign, CN = GlobalSign Timestamping CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E8:C2:F1:C4:32:DC:33:35:37:BC:65:76:F5:9C:17:2E:17:45:2C:FE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.30
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D0CAE6947BC77F0B495CA808D6CDE685FCD20225E1E530B635B113ED40728EF3
    SPKI SHA256: 709CB325047D99A8320F977D0B67CB1ABBBC02A8BE3E0B44403ED33360EAFAA2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.30
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign Timestamping CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE152D7
- SHA-256: C977923C771E1A66C925A2B6F501732E678DC9887AFE6BFAAC039D1D9A71F0EC
- SPKI SHA-256: 081D6EFC7C103D34D514DCABBA80C10D495EF3EA0FCD4B344A8B3F299B8BA126
- Validity: 2011-04-13 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gstimestampingg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:52:d7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                46:D8:3E:FF:DC:E3:BE:FF:83:E6:F4:85:9B:B0:DD:6A:D6:14:A9:C1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C977923C771E1A66C925A2B6F501732E678DC9887AFE6BFAAC039D1D9A71F0EC
    SPKI SHA256: 081D6EFC7C103D34D514DCABBA80C10D495EF3EA0FCD4B344A8B3F299B8BA126
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign Timestamping CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7653FE3B37EE95752C6A20E5C8945CC1
- SHA-256: 95C6A747DD0BC755A1941827E894B8083592241B792541E2EB1B30FB9B13F57F
- SPKI SHA-256: 116819B87CCC39BE19767194F48C5F1C03F3CE878F723286E1EE37C7AD1F39B9
- Validity: 2020-01-22 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gstimestampingg3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:3b:37:ee:95:75:2c:6a:20:e5:c8:94:5c:c1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Jan 28 00:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D9:EB:B2:88:4F:47:8A:F9:17:EA:86:D1:49:8C:B0:33:9E:60:09:12
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 95C6A747DD0BC755A1941827E894B8083592241B792541E2EB1B30FB9B13F57F
    SPKI SHA256: 116819B87CCC39BE19767194F48C5F1C03F3CE878F723286E1EE37C7AD1F39B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Timestamping CA - R3

- Subject: organizationalUnitName=Timestamping CA, organizationName=GlobalSign, commonName=GlobalSign Timestamping CA - R3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000127FBD22364
- SHA-256: 61C1067083AE044EF1D649CE590BBF09D9D739E025DA8D195F71CFAAD6EBAE69
- SPKI SHA-256: EA9D660686A6E29E699153CA21B7768F0416CAEE4079B1278A95FEDB97A88918
- Validity: 2010-04-14 to 2029-03-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.net/Timestamping-r3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:d2:23:64
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 14 11:00:00 2010 GMT
            Not After : Mar 10 11:00:00 2029 GMT
        Subject: OU = Timestamping CA, O = GlobalSign, CN = GlobalSign Timestamping CA - R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8C:5A:62:2C:AA:5A:D2:D3:F2:07:A7:A1:96:5C:6B:8B:FE:9F:B3:65
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.30
                  CPS: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 61C1067083AE044EF1D649CE590BBF09D9D739E025DA8D195F71CFAAD6EBAE69
    SPKI SHA256: EA9D660686A6E29E699153CA21B7768F0416CAEE4079B1278A95FEDB97A88918
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.30
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign Timestamping CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C65004
- SHA-256: 9BF9496777D14425ED0086C1BB2C0707B62A61C194C5162E4F07637AFF166B76
- SPKI SHA-256: A8D47E0F0C9A9CB37232EACCC1C5295628D05CAE89946C9DC73EDBD82349C799
- Validity: 2011-08-02 to 2029-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:50:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Mar 29 10:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                92:21:A7:4A:95:5D:64:B0:9B:B4:1E:E6:00:37:47:E6:9D:41:2B:4C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9BF9496777D14425ED0086C1BB2C0707B62A61C194C5162E4F07637AFF166B76
    SPKI SHA256: A8D47E0F0C9A9CB37232EACCC1C5295628D05CAE89946C9DC73EDBD82349C799
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### GlobalSign Timestamping CA - SHA256 - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA256 - G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE404890883ECF30948D0A656DD2
- SHA-256: BE33D1C57EBDDD927B57BDB604BE457B552FE568E7F3DCBA093C39ED1C30A239
- SPKI SHA-256: D0826F1397A55F1EB2B741EC5D6CEDC1CA4C9B5E422BB99039B50521D6C35900
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gs/gstimestampingsha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:40:48:90:88:3e:cf:30:94:8d:0a:65:6d:d2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping CA - SHA256 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9C:94:32:E0:5A:D7:FA:ED:33:47:ED:1E:6F:37:A5:8D:FE:80:04:39
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.30
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BE33D1C57EBDDD927B57BDB604BE457B552FE568E7F3DCBA093C39ED1C30A239
    SPKI SHA256: D0826F1397A55F1EB2B741EC5D6CEDC1CA4C9B5E422BB99039B50521D6C35900
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.30
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Timestamping CA - SHA384 - G4

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping CA - SHA384 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01EC1C9240DEFD2E405D7C4774
- SHA-256: F642418E4D0C63DEC785C960EFA68BA745F38851744EF81F225CB89305314D50
- SPKI SHA-256: 6F12F6858A6B1CFC1745C3334CE64C0C63A027C577E949E005858C366A724D40
- Validity: 2018-06-20 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gstsacasha384g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 20 00:00:00 2018 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping CA - SHA384 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:16:C6:69:E7:E3:CB:57:45:39:33:A4:F0:40:BE:D0:C3:BD:65:96
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F642418E4D0C63DEC785C960EFA68BA745F38851744EF81F225CB89305314D50
    SPKI SHA256: 6F12F6858A6B1CFC1745C3334CE64C0C63A027C577E949E005858C366A724D40
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### GlobalSign Timestamping Root E46

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root E46
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7B29CEAC1C009DB9D81D84B7C0BDA45C
- SHA-256: 24E9A5B561CDFEFEEEB73245DAC1B04465C513F936621D21902DD8A58FD6C461
- SPKI SHA-256: AC78E34905350F709804A191F2BD537D886DEDEA03D30CEA65B0854B6758FB2D
- Validity: 2021-11-17 to 2031-11-17
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/timestamproote46.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:29:ce:ac:1c:00:9d:b9:d8:1d:84:b7:c0:bd:a4:5c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 17 12:00:00 2021 GMT
            Not After : Nov 17 00:00:00 2031 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root E46
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A6:59:3C:E9:66:30:2E:12:99:55:11:A6:80:EE:1E:08:FC:7C:B8:99
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 24E9A5B561CDFEFEEEB73245DAC1B04465C513F936621D21902DD8A58FD6C461
    SPKI SHA256: AC78E34905350F709804A191F2BD537D886DEDEA03D30CEA65B0854B6758FB2D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign Timestamping Root R45

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Timestamping Root R45
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 784AAA8173669C900954E421C947EBC0
- SHA-256: 6AFBC07C724C6F75C7743392F32BF5780BD5DD39268544D4882E7AEC1ADD0282
- SPKI SHA-256: 16B0D55042A7D9CEB2F1204AA64C65B3A9046E9ECF1BEF5421F3D2BE1BC5FFAC
- Validity: 2020-12-09 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/timestamprootr45.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Timestamping Root R45
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                46:B2:1C:77:E1:7B:15:F0:A5:39:A1:70:DE:D1:C4:2E:EA:6D:B2:DE
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6AFBC07C724C6F75C7743392F32BF5780BD5DD39268544D4882E7AEC1ADD0282
    SPKI SHA256: 16B0D55042A7D9CEB2F1204AA64C65B3A9046E9ECF1BEF5421F3D2BE1BC5FFAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign TLS Root E41

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root E41
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root E46
- Serial: 85DB0E911D5AA1F5D397E7FAED1B340B
- SHA-256: 0FA1FCDC8C3AE03355D7062A025CD08F2EA98238708CD04D5D3CB8509C3B67FB
- SPKI SHA-256: F1F3184513F60E70474E6D77C2B1C3F719B2E457A338E7BFF67A47E1FABADC75
- Validity: 2026-05-20 to 2041-03-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gstlsroote41.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/roote46
- CRL DP: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:db:0e:91:1d:5a:a1:f5:d3:97:e7:fa:ed:1b:34:0b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root E46
        Validity
            Not Before: May 20 03:21:59 2026 GMT
            Not After : Mar 31 00:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root E41
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                F1:D9:7F:58:8F:6E:70:70:45:83:59:6F:72:6E:CB:23:39:B5:CF:B9
            X509v3 Authority Key Identifier:
                31:0A:90:8F:B6:C6:9D:D2:44:4B:80:B5:A2:E6:1F:B1:12:4F:1B:95
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/roote46
                CA Issuers - URI:http://secure.globalsign.com/cacert/roote46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/roote46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0FA1FCDC8C3AE03355D7062A025CD08F2EA98238708CD04D5D3CB8509C3B67FB
    SPKI SHA256: F1F3184513F60E70474E6D77C2B1C3F719B2E457A338E7BFF67A47E1FABADC75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/roote46
- AIA CA Issuers: http://secure.globalsign.com/cacert/roote46.crt
- CRL Distribution Points: http://crl.globalsign.com/roote46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign TLS Root R41

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TLS Root R41
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 85DB0E7642C3A1656F7400DB5B3EC615
- SHA-256: C95379845A31D95E990515126DD9BF77E1ED4D63C34EFCEA416074E6F9FA8643
- SPKI SHA-256: AF003DED1DDF527C54F49746170362AB64EF673C30F27F5F62822346808BC241
- Validity: 2026-05-20 to 2041-03-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/gstlsrootr41.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:db:0e:76:42:c3:a1:65:6f:74:00:db:5b:3e:c6:15
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: May 20 03:21:37 2026 GMT
            Not After : Mar 31 00:00:00 2041 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TLS Root R41
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AD:C9:B7:C7:D1:ED:AC:6C:AA:4D:BE:F1:5E:70:36:73:44:EE:67:3C
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C95379845A31D95E990515126DD9BF77E1ED4D63C34EFCEA416074E6F9FA8643
    SPKI SHA256: AF003DED1DDF527C54F49746170362AB64EF673C30F27F5F62822346808BC241
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1, 1.3.6.1.4.1.4146.10.1.3, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GlobalSign TSA CA for AATL

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign TSA CA for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA384 - G4
- Serial: 01E9D8A4CC18236C2A58C1AF8C
- SHA-256: 4D8EB49380EC72AC9FDF21FE1C6DB2E9490C76BEADD1F7B528C3CCD272C8FE28
- SPKI SHA-256: E3D9488D20271F03AE556B8E47E453B849734218176820B7CBD8B3FE7AD03762
- Validity: 2018-04-18 to 2029-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/gstsasha2g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- CRL DP: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e9:d8:a4:cc:18:23:6c:2a:58:c1:af:8c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA384 - G4
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : May 18 00:00:00 2029 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign TSA CA for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3E:B3:ED:0E:33:4E:06:1E:E0:95:B2:7D:12:9F:B8:0A:47:80:A7:A7
            X509v3 Authority Key Identifier:
                89:EF:75:71:7A:5F:47:1B:97:23:DC:90:4A:CB:FF:C0:26:36:08:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ca/gsaatlsha2g4
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/ca/gsaatlsha2g4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4D8EB49380EC72AC9FDF21FE1C6DB2E9490C76BEADD1F7B528C3CCD272C8FE28
    SPKI SHA256: E3D9488D20271F03AE556B8E47E453B849734218176820B7CBD8B3FE7AD03762
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ca/gsaatlsha2g4
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g4.crt
- CRL Distribution Points: http://crl.globalsign.com/ca/gsaatlsha2g4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Google S/MIME Authority

- Subject: countryName=US, organizationName=Google Inc, stateOrProvinceName=California, commonName=Google S/MIME Authority
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 468E758C12321DBE1EE8C46EEAEA
- SHA-256: 6A1745B31176FAC284420A2BCEF67B59E22A1D37753ABAF2CC51B2F572922588
- SPKI SHA-256: E8EB115F3E0D6904ED1DCD1EC604558A9573D763B11EFB09C7DD5B7862482126
- Validity: 2015-05-20 to 2025-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://smime.gstatic.com/gsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:8e:75:8c:12:32:1d:be:1e:e8:c4:6e:ea:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 20 00:00:00 2015 GMT
            Not After : May 20 00:00:00 2025 GMT
        Subject: C = US, O = Google Inc, ST = California, CN = Google S/MIME Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                C1:94:F6:E3:16:84:DF:7C:EF:60:3F:78:9D:74:31:C7:5D:CC:BC:D2
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://smime.gstatic.com/gsr3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6A1745B31176FAC284420A2BCEF67B59E22A1D37753ABAF2CC51B2F572922588
    SPKI SHA256: E8EB115F3E0D6904ED1DCD1EC604558A9573D763B11EFB09C7DD5B7862482126
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://smime.gstatic.com/gsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Gracenote Root CA

- Subject: organizationName=Gracenote Inc, commonName=Gracenote Root CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000127FB9F45D8
- SHA-256: FABD05A6D760EBAF5A30BEC707C3497993F9B0163BD62345F790F878C0427379
- SPKI SHA-256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
- Validity: 2010-04-14 to 2020-04-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:9f:45:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Apr 14 10:00:00 2010 GMT
            Not After : Apr 14 10:00:00 2020 GMT
        Subject: O = Gracenote Inc, CN = Gracenote Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                76:D8:C8:97:32:EB:21:78:A1:A6:F9:66:65:11:20:33:A7:8E:2C:20
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.35077.509.2.1
                  User Notice:
                    Explicit Text: http://www.gracenote.com/pki/cps.html
                Policy: 1.3.6.1.4.1.35077.509.2.2
                Policy: 1.3.6.1.4.1.35077.509.2.3
                Policy: 1.3.6.1.4.1.35077.509.2.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FABD05A6D760EBAF5A30BEC707C3497993F9B0163BD62345F790F878C0427379
    SPKI SHA256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Gracenote Root CA

- Subject: organizationName=Gracenote Inc, commonName=Gracenote Root CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 040000000001281FCE1AA2
- SHA-256: 99D0A6F6C85DB93B69159A1F8FCFB5A39A569F1F950ECAC9CB647C1A4639A0B7
- SPKI SHA-256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
- Validity: 2010-04-21 to 2020-04-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.1.1, 1.3.6.1.4.1.35077.509.1.2, 1.3.6.1.4.1.35077.509.1.3, 1.3.6.1.4.1.35077.509.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:28:1f:ce:1a:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Apr 21 10:00:00 2010 GMT
            Not After : Apr 21 10:00:00 2020 GMT
        Subject: O = Gracenote Inc, CN = Gracenote Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                76:D8:C8:97:32:EB:21:78:A1:A6:F9:66:65:11:20:33:A7:8E:2C:20
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.net/repository/
                Policy: 1.3.6.1.4.1.35077.509.1.1
                  User Notice:
                    Explicit Text: http://www.gracenote.com/pki/cps.html
                Policy: 1.3.6.1.4.1.35077.509.1.2
                Policy: 1.3.6.1.4.1.35077.509.1.3
                Policy: 1.3.6.1.4.1.35077.509.1.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 99D0A6F6C85DB93B69159A1F8FCFB5A39A569F1F950ECAC9CB647C1A4639A0B7
    SPKI SHA256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.1.1, 1.3.6.1.4.1.35077.509.1.2, 1.3.6.1.4.1.35077.509.1.3, 1.3.6.1.4.1.35077.509.1.4
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Gracenote Root CA

- Subject: organizationName=Gracenote Inc, commonName=Gracenote Root CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000127FB9F4962
- SHA-256: 1F98F88AC237A339BF2EC4C446E3F202EA33AB6D15F49235D60EE180F7209B94
- SPKI SHA-256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
- Validity: 2010-04-14 to 2020-04-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 3
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:9f:49:62
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Apr 14 10:00:00 2010 GMT
            Not After : Apr 14 10:00:00 2020 GMT
        Subject: O = Gracenote Inc, CN = Gracenote Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:3
            X509v3 Subject Key Identifier:
                76:D8:C8:97:32:EB:21:78:A1:A6:F9:66:65:11:20:33:A7:8E:2C:20
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.35077.509.2.1
                  User Notice:
                    Explicit Text: http://www.gracenote.com/pki/cps.html
                Policy: 1.3.6.1.4.1.35077.509.2.2
                Policy: 1.3.6.1.4.1.35077.509.2.3
                Policy: 1.3.6.1.4.1.35077.509.2.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1F98F88AC237A339BF2EC4C446E3F202EA33AB6D15F49235D60EE180F7209B94
    SPKI SHA256: 8D6BB340A9D083230468A8823966216B4782D6B7AA7EA743DB0B22A2B21C2E14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":3}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.35077.509.2.1, 1.3.6.1.4.1.35077.509.2.2, 1.3.6.1.4.1.35077.509.2.3, 1.3.6.1.4.1.35077.509.2.4
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GROB-WERKE GmbH und Co. KG Atlas R45 SMIME CA 2025

- Subject: countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 831489B90942D12971BCCDA4CF808737
- SHA-256: C1E6B13C34B8029F8BBCEEACF9F543EBF02A1CC4D56255FCC51BAC3EA794BE4E
- SPKI SHA-256: 81FF102DB39B07E9542A99136B112307A8C38EB494853726331B989938BB5DCE
- Validity: 2025-03-19 to 2035-03-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/grobwerkeatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:14:89:b9:09:42:d1:29:71:bc:cd:a4:cf:80:87:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Mar 19 03:31:07 2025 GMT
            Not After : Mar 19 00:00:00 2035 GMT
        Subject: C = DE, O = GROB-WERKE GmbH und Co. KG, CN = GROB-WERKE GmbH und Co. KG Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EC:2B:AF:59:D2:C6:24:D1:83:DC:E2:C7:55:85:21:C2:86:D0:08:34
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C1E6B13C34B8029F8BBCEEACF9F543EBF02A1CC4D56255FCC51BAC3EA794BE4E
    SPKI SHA256: 81FF102DB39B07E9542A99136B112307A8C38EB494853726331B989938BB5DCE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020

- Subject: countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031AA0AE64FF7557A9DBE4AACBA1F8
- SHA-256: B75840FEA15C545335CD4BA58B707F53524CE984655AEBCC248A57E6F2403A8B
- SPKI SHA-256: BECC5621C02165C8D3E74FE1CCAB81143A6A442D53FBCBE6B5B784C9A28C6A75
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/grobwerkegccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:a0:ae:64:ff:75:57:a9:db:e4:aa:cb:a1:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = GROB-WERKE GmbH und Co. KG, CN = GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5A:18:A2:7C:45:7E:3D:D5:D8:8F:A6:D6:50:0C:E8:2C:66:DC:E9:42
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B75840FEA15C545335CD4BA58B707F53524CE984655AEBCC248A57E6F2403A8B
    SPKI SHA256: BECC5621C02165C8D3E74FE1CCAB81143A6A442D53FBCBE6B5B784C9A28C6A75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020

- Subject: countryName=DE, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC371EBEEF418515BA74E505135532
- SHA-256: 6FC0296F355073DD3622150FB496EB455C8C547146191076C5AF76FA9C36C238
- SPKI SHA-256: BECC5621C02165C8D3E74FE1CCAB81143A6A442D53FBCBE6B5B784C9A28C6A75
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/grobwerkegccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:1e:be:ef:41:85:15:ba:74:e5:05:13:55:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:30:42 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = DE, O = GROB-WERKE GmbH und Co. KG, CN = GROB-WERKE GmbH und Co. KG GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5A:18:A2:7C:45:7E:3D:D5:D8:8F:A6:D6:50:0C:E8:2C:66:DC:E9:42
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6FC0296F355073DD3622150FB496EB455C8C547146191076C5AF76FA9C36C238
    SPKI SHA256: BECC5621C02165C8D3E74FE1CCAB81143A6A442D53FBCBE6B5B784C9A28C6A75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GROB-WERKE GmbH und Co. KG SMIME CA

- Subject: countryName=DE, stateOrProvinceName=Bayern, localityName=Mindelheim, organizationName=GROB-WERKE GmbH und Co. KG, commonName=GROB-WERKE GmbH und Co. KG SMIME CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01EE5F1A2CF7256B18EE96233A
- SHA-256: 1608BF87414CDCFAB4279102A19702D9D5996A91329E3DF2F80495473AAD86C6
- SPKI SHA-256: F42E82324B9CAE31338EE1C9D3F62F8BFDE168840DC12B2F83A754440182BD0C
- Validity: 2018-10-17 to 2023-10-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:1a:2c:f7:25:6b:18:ee:96:23:3a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Oct 17 00:00:00 2018 GMT
            Not After : Oct 17 00:00:00 2023 GMT
        Subject: C = DE, ST = Bayern, L = Mindelheim, O = GROB-WERKE GmbH und Co. KG, CN = GROB-WERKE GmbH und Co. KG SMIME CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1C:A5:5B:17:EF:4C:48:8D:38:0E:8F:AE:69:96:B9:C0:D7:5C:18:0D
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1608BF87414CDCFAB4279102A19702D9D5996A91329E3DF2F80495473AAD86C6
    SPKI SHA256: F42E82324B9CAE31338EE1C9D3F62F8BFDE168840DC12B2F83A754440182BD0C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GTS Root R1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 77BD0D6CDB36F91AEA210FC4F058D30D
- SHA-256: 3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5
- SPKI SHA-256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
- Validity: 2020-06-19 to 2028-01-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Google Trust Services LLC
- CP/CPS: https://pki.goog/repo/cp-cps-smime/6.7/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.8/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr1/gtsr1.crl, http://c.pki.goog/r/r1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3.2, 1.3.6.1.4.1.11129.2.5.3.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gsr1
- CRL DP: http://crl.pki.goog/gsr1/gsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:6c:db:36:f9:1a:ea:21:0f:c4:f0:58:d3:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jun 19 00:00:42 2020 GMT
            Not After : Jan 28 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr1
                CA Issuers - URI:http://pki.goog/gsr1/gsr1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr1/gsr1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.11129.2.5.3.2
                Policy: 1.3.6.1.4.1.11129.2.5.3.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5
    SPKI SHA256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3.2, 1.3.6.1.4.1.11129.2.5.3.3
- AIA OCSP: http://ocsp.pki.goog/gsr1
- AIA CA Issuers: http://pki.goog/gsr1/gsr1.crt
- CRL Distribution Points: http://crl.pki.goog/gsr1/gsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Root R4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 7FE530BF331343BEDD821610493D8A1B
- SHA-256: 76B27B80A58027DC3CF1DA68DAC17010ED93997D0B603E2FADBE85012493B5A7
- SPKI SHA-256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
- Validity: 2023-11-15 to 2028-01-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Google Trust Services LLC
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.8/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr4/gtsr4.crl, http://c.pki.goog/r/r4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/gsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:e5:30:bf:33:13:43:be:dd:82:16:10:49:3d:8a:1b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Nov 15 03:43:21 2023 GMT
            Not After : Jan 28 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/gsr1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/gsr1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 76B27B80A58027DC3CF1DA68DAC17010ED93997D0B603E2FADBE85012493B5A7
    SPKI SHA256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/gsr1.crt
- CRL Distribution Points: http://c.pki.goog/r/gsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### HERTZ GCC R45 SMIME CA 2020

- Subject: countryName=US, organizationName=The HERTZ Corporation, commonName=HERTZ GCC R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 780318550A6F964548C66507291DA945
- SHA-256: 013C13426B92F703BA573D9E16C2E35AECA26C60F606B88D3CE2150C94D56C14
- SPKI SHA-256: C0D10D75035D65382C546427A355668C540923841C88D80A827D227DD0F91600
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/hertzgccr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:55:0a:6f:96:45:48:c6:65:07:29:1d:a9:45
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = US, O = The HERTZ Corporation, CN = HERTZ GCC R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CA:04:E7:03:4D:36:3E:C6:AD:EB:1B:72:56:93:D3:8A:E7:83:D8:36
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 013C13426B92F703BA573D9E16C2E35AECA26C60F606B88D3CE2150C94D56C14
    SPKI SHA256: C0D10D75035D65382C546427A355668C540923841C88D80A827D227DD0F91600
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HERTZ SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=Florida, organizationName=The HERTZ Corporation, commonName=HERTZ SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01EC1C8CF55FBE225F5D878ABD
- SHA-256: 64FD7F66B805EF0FAE09DAC06EAD1A9AB5C28E6F24AD0759996D349987FEE7E2
- SPKI SHA-256: D2613D8BDC1AC3A154ED3F63B61CD1E915AA56561F3995A70EDFFF5BBC3431B1
- Validity: 2018-04-18 to 2023-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ec:1c:8c:f5:5f:be:22:5f:5d:87:8a:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Apr 18 00:00:00 2018 GMT
            Not After : Apr 18 00:00:00 2023 GMT
        Subject: C = US, ST = Florida, O = The HERTZ Corporation, CN = HERTZ SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                89:DC:58:1E:60:45:17:88:E9:B8:A5:A5:BD:EE:20:06:C7:4A:51:88
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 64FD7F66B805EF0FAE09DAC06EAD1A9AB5C28E6F24AD0759996D349987FEE7E2
    SPKI SHA256: D2613D8BDC1AC3A154ED3F63B61CD1E915AA56561F3995A70EDFFF5BBC3431B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Hongkong Post Root CA 3

- Subject: countryName=HK, stateOrProvinceName=Hong Kong, localityName=Hong Kong, organizationName=Hongkong Post, commonName=Hongkong Post Root CA 3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7D877BD11424C2260C702C5DEB33AB17
- SHA-256: 00482341B104A0DE6E0F1D508DB84CB514F7494FE04982133A5C750136C55DC8
- SPKI SHA-256: 2541E53BA5B3B07ACBE7097AC4A03E040C11CF7A6D4A67CB213D558B50167A06
- Validity: 2022-11-16 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Government of Hong Kong (SAR), Hongkong Post, Certizen
- CP/CPS: https://www.ecert.gov.hk/product/cps/ecert/img/server_cps_en28.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e22e872f-ec7c-4c2b-b0ea-6bc1771f4316, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2ada7687-891a-461e-b9d3-730cc5113dc0, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e93adaf2-39da-406c-bd10-1e0c22d27650, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=832a4fc9-4c21-4da1-86d6-d096ee44fc62
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl1.ecert.gov.hk/crl/RootCA3ARL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:87:7b:d1:14:24:c2:26:0c:70:2c:5d:eb:33:ab:17
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 16 03:35:08 2022 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = HK, ST = Hong Kong, L = Hong Kong, O = Hongkong Post, CN = Hongkong Post Root CA 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                17:9D:CD:1E:8B:D6:39:2B:70:D3:5C:D4:A0:B8:1F:B0:00:FC:C5:61
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 00482341B104A0DE6E0F1D508DB84CB514F7494FE04982133A5C750136C55DC8
    SPKI SHA256: 2541E53BA5B3B07ACBE7097AC4A03E040C11CF7A6D4A67CB213D558B50167A06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Hyperion GCC R3 SMIME CA 2020

- Subject: countryName=GB, organizationName=Hyperion Services Ltd., commonName=Hyperion GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031AA32B83E9C1F0797AACACBC8135
- SHA-256: 9537738522B6A87FCF8338CF270203CCF1A7770BB14BB23FA2882A05FFB804E4
- SPKI SHA-256: D13C765651FB94D764D564A0C0FFD31020D5F2FCB4C8FB70C77DE9E926943C83
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/hyperiongccr3smimeca2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:a3:2b:83:e9:c1:f0:79:7a:ac:ac:bc:81:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = GB, O = Hyperion Services Ltd., CN = Hyperion GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8F:95:09:1E:CB:D3:23:2E:37:95:87:33:69:87:D6:6B:4C:38:B5:5E
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9537738522B6A87FCF8338CF270203CCF1A7770BB14BB23FA2882A05FFB804E4
    SPKI SHA256: D13C765651FB94D764D564A0C0FFD31020D5F2FCB4C8FB70C77DE9E926943C83
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Hyperion SMIME CA 2018

- Subject: countryName=GB, stateOrProvinceName=London, localityName=London, organizationName=Hyperion Services Ltd., commonName=Hyperion SMIME CA 2018
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01EE5F160BC0E46FDEC1AF59EB
- SHA-256: DCD77E34B46D530AEF645A513389CD4FFC0F7D196A115B8F62A5FD0D557D46C6
- SPKI SHA-256: 2996DB5F79FA928F8853DF21BAB735120AC5BE4D68DAFC037C2EB13191FFEDA0
- Validity: 2018-08-27 to 2023-08-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:16:0b:c0:e4:6f:de:c1:af:59:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Aug 27 00:00:00 2018 GMT
            Not After : Aug 27 00:00:00 2023 GMT
        Subject: C = GB, ST = London, L = London, O = Hyperion Services Ltd., CN = Hyperion SMIME CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C1:9A:13:1E:C1:FC:1D:67:31:BE:87:01:B2:AA:97:CF:03:A2:75:48
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DCD77E34B46D530AEF645A513389CD4FFC0F7D196A115B8F62A5FD0D557D46C6
    SPKI SHA256: 2996DB5F79FA928F8853DF21BAB735120AC5BE4D68DAFC037C2EB13191FFEDA0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ICPEdu

- Subject: countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=ICPEdu
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0DA91E66472B2A5518352F63523D
- SHA-256: D5E84D9A677E6CDA72DD1C1BA7AD8DDFC25EFAC220C8A9571CEC27C107555702
- SPKI SHA-256: 9BF6647B67FA43A69CA2EF9938583EF0E7520B38A7B7FE6EA2C4986855C4DC43
- Validity: 2020-07-05 to 2021-03-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:a9:1e:66:47:2b:2a:55:18:35:2f:63:52:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Mar  4 00:00:00 2021 GMT
        Subject: C = BR, O = Rede Nacional de Ensino e Pesquisa - RNP, CN = ICPEdu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                95:F0:A4:84:1A:A7:5C:20:36:A6:C5:08:D7:65:42:02:E5:77:68:E3
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D5E84D9A677E6CDA72DD1C1BA7AD8DDFC25EFAC220C8A9571CEC27C107555702
    SPKI SHA256: 9BF6647B67FA43A69CA2EF9938583EF0E7520B38A7B7FE6EA2C4986855C4DC43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### ICPEdu

- Subject: countryName=BR, stateOrProvinceName=Rio de Janeiro, localityName=Rio de Janeiro, organizationalUnitName=Gerencia de Servicos (GSer), organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=ICPEdu
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 57B09EEF615610874491E92C5462F46196
- SHA-256: EACBA6C96598B4A41FD53D69AB9ED9FBBB1381154C453456720C174FFE576D1D
- SPKI SHA-256: 9BF6647B67FA43A69CA2EF9938583EF0E7520B38A7B7FE6EA2C4986855C4DC43
- Validity: 2014-03-04 to 2021-03-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:b0:9e:ef:61:56:10:87:44:91:e9:2c:54:62:f4:61:96
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Mar  4 00:00:00 2014 GMT
            Not After : Mar  4 00:00:00 2021 GMT
        Subject: C = BR, ST = Rio de Janeiro, L = Rio de Janeiro, OU = Gerencia de Servicos (GSer), O = Rede Nacional de Ensino e Pesquisa - RNP, CN = ICPEdu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Subject Key Identifier:
                95:F0:A4:84:1A:A7:5C:20:36:A6:C5:08:D7:65:42:02:E5:77:68:E3
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EACBA6C96598B4A41FD53D69AB9ED9FBBB1381154C453456720C174FFE576D1D
    SPKI SHA256: 9BF6647B67FA43A69CA2EF9938583EF0E7520B38A7B7FE6EA2C4986855C4DC43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHI E and C International

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=IHI-EC International Corporation, commonName=IHI E and C International
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E707CDD1C17A6A362E1C5FD6
- SHA-256: F490F7A7F052F7B130268FCB2BE19A4132C8B1007F09D606685927122EE7A83C
- SPKI SHA-256: 0ACD3DB399357AB44173B797DBC55B49C2E9682B2EC2A56149900D75CCB3BDB9
- Validity: 2017-12-06 to 2018-04-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:cd:d1:c1:7a:6a:36:2e:1c:5f:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec  6 00:00:00 2017 GMT
            Not After : Apr  6 00:00:00 2018 GMT
        Subject: C = US, ST = Texas, L = Houston, O = IHI-EC International Corporation, CN = IHI E and C International
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                12:38:69:14:21:C4:49:A9:6D:11:CB:34:39:9D:5F:96:22:E0:AA:0A
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.ihi-ec.com
                  email:ihi-ec.com
                  DNS:ihi-ec.com
                  DirName:O = IHI-EC International Corporation
                  DirName:C = US, O = IHI-EC International Corporation
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F490F7A7F052F7B130268FCB2BE19A4132C8B1007F09D606685927122EE7A83C
    SPKI SHA256: 0ACD3DB399357AB44173B797DBC55B49C2E9682B2EC2A56149900D75CCB3BDB9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHI-EC International Corporation

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=IHI-EC International Corporation, commonName=IHI-EC International Corporation
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E707D2185CE41D5E6BB4E404
- SHA-256: 57579253274080585F43CFDAA3D07A28A8FBCE6228B52CE3A320DECD247CF6CE
- SPKI SHA-256: F18FC654970661881133B70E54B8BEDDDC1AD93DB5AEEA87667D77D4A06A6144
- Validity: 2018-01-17 to 2019-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:d2:18:5c:e4:1d:5e:6b:b4:e4:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jan 17 00:00:00 2018 GMT
            Not After : Jul 17 00:00:00 2019 GMT
        Subject: C = US, ST = Texas, L = Houston, O = IHI-EC International Corporation, CN = IHI-EC International Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7E:CD:FE:74:23:68:21:7A:FE:22:18:0E:92:40:A2:78:D8:E9:55:00
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.ihi-ec.com
                  email:ihi-ec.com
                  DNS:ihi-ec.com
                  DirName:O = IHI-EC International Corporation
                  DirName:C = US, O = IHI-EC International Corporation
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 57579253274080585F43CFDAA3D07A28A8FBCE6228B52CE3A320DECD247CF6CE
    SPKI SHA256: F18FC654970661881133B70E54B8BEDDDC1AD93DB5AEEA87667D77D4A06A6144
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### IHI-EC International Corporation

- Subject: countryName=US, organizationName=IHI E&C International Corporation, commonName=IHI-EC International Corporation
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 75A8BA9E2A49D997E457E4008C48E216
- SHA-256: DC1983F14B0096FB12A6D82B4822730D238779CA0543C43C015F249249564D4D
- SPKI SHA-256: D68DA3E67660BC8E5D5709A96221EC75550A5B0CF792393DCDB0D8BDD4ABB09A
- Validity: 2019-10-22 to 2020-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:ba:9e:2a:49:d9:97:e4:57:e4:00:8c:48:e2:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Oct 22 00:00:00 2019 GMT
            Not After : Jul 31 00:00:00 2020 GMT
        Subject: C = US, O = IHI E&C International Corporation, CN = IHI-EC International Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DD:BB:5B:C8:CC:83:67:45:EB:39:AA:14:41:0A:96:EA:00:29:13:A6
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.ihi-ec.com
                  email:ihi-ec.com
                  DNS:ihi-ec.com
                  DirName:C = US, O = IHI E&C International Corporation
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC1983F14B0096FB12A6D82B4822730D238779CA0543C43C015F249249564D4D
    SPKI SHA256: D68DA3E67660BC8E5D5709A96221EC75550A5B0CF792393DCDB0D8BDD4ABB09A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.ihi-ec.com","email:ihi-ec.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### InComm Agent Solutions Inc Atlas Issuing CA 2020

- Subject: countryName=US, organizationName=InComm Agent Solutions Inc, commonName=InComm Agent Solutions Inc Atlas Issuing CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 784AAA80BF58549EDFB02E153B0D19AC
- SHA-256: 4DFD9A61EB32208A94F15719FF2EC71449BCB0F344C18D5D1D3994A6C30EC92E
- SPKI SHA-256: CD615C6C42AB4D6107FBD6EC45C2E570538316FF79F43B603C7D01B9A630CE71
- Validity: 2020-12-09 to 2030-12-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/incommatlasica2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:80:bf:58:54:9e:df:b0:2e:15:3b:0d:19:ac
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Dec  9 00:00:00 2020 GMT
            Not After : Dec  9 00:00:00 2030 GMT
        Subject: C = US, O = InComm Agent Solutions Inc, CN = InComm Agent Solutions Inc Atlas Issuing CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:95:82:0C:EB:D2:C0:0B:DA:1D:A3:DD:D6:2E:4C:37:B1:7E:2C:C4
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4DFD9A61EB32208A94F15719FF2EC71449BCB0F344C18D5D1D3994A6C30EC92E
    SPKI SHA256: CD615C6C42AB4D6107FBD6EC45C2E570538316FF79F43B603C7D01B9A630CE71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.60
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InComm Agent Solutions Inc Root Certificate Authority

- Subject: countryName=US, stateOrProvinceName=Florida, organizationName=InComm Agent Solutions Inc, commonName=InComm Agent Solutions Inc Root Certificate Authority
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E528B258B5527AF42BDED77F
- SHA-256: 2A5EAD8B41A7CDDC126B10ED248A2EEFEDA855660342F222A38CC6605D443E22
- SPKI SHA-256: 82345A9F8E5D16895F1396AD533139611CA244FF9499EDBC8EEB4919AE05E764
- Validity: 2017-08-23 to 2021-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.41209.509.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.incommagentsolutions.biz","email:.incommagentsolutions.com","email:.miestrella123.com","email:.miestrella123.net","email:.mystar123.com","email:.polandunlimited.com","email:.qpay123.biz","email:.qpay123.com","email:.qpaybi.com","email:.qpaynet.com","email:.qpayreport.com","email:.qpayreporting.com","email:.sinlimitemexico.com","email:incommagentsolutions.biz","email:incommagentsolutions.com","email:miestrella123.com","email:miestrella123.net","email:mystar123.com","email:polandunlimited.com","email:qpay123.biz","email:qpay123.com","email:qpaybi.com","email:qpaynet.com","email:qpayreport.com","email:qpayreporting.com","email:sinlimitemexico.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b2:58:b5:52:7a:f4:2b:de:d7:7f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Aug 23 00:00:00 2017 GMT
            Not After : Aug 23 00:00:00 2021 GMT
        Subject: C = US, ST = Florida, O = InComm Agent Solutions Inc, CN = InComm Agent Solutions Inc Root Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                BB:2A:1A:D0:FE:7F:DD:60:A0:3B:D9:8D:54:4E:95:8E:A7:7E:BC:C1
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:.incommagentsolutions.biz
                  email:.incommagentsolutions.com
                  email:.miestrella123.com
                  email:.miestrella123.net
                  email:.mystar123.com
                  email:.polandunlimited.com
                  email:.qpay123.biz
                  email:.qpay123.com
                  email:.qpaybi.com
                  email:.qpaynet.com
                  email:.qpayreport.com
                  email:.qpayreporting.com
                  email:.sinlimitemexico.com
                  email:incommagentsolutions.biz
                  email:incommagentsolutions.com
                  email:miestrella123.com
                  email:miestrella123.net
                  email:mystar123.com
                  email:polandunlimited.com
                  email:qpay123.biz
                  email:qpay123.com
                  email:qpaybi.com
                  email:qpaynet.com
                  email:qpayreport.com
                  email:qpayreporting.com
                  email:sinlimitemexico.com
                  DNS:incommagentsolutions.biz
                  DNS:incommagentsolutions.com
                  DNS:miestrella123.com
                  DNS:miestrella123.net
                  DNS:mystar123.com
                  DNS:polandunlimited.com
                  DNS:qpay123.biz
                  DNS:qpay123.com
                  DNS:qpaybi.com
                  DNS:qpaynet.com
                  DNS:qpayreport.com
                  DNS:qpayreporting.com
                  DNS:sinlimitemexico.com
                  DirName:C = US, ST = Florida, O = InComm Agent Solutions Inc
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.41209.509.1.1
                  CPS: http://pki.qpay123.com/cps.html
                  User Notice:
                    Explicit Text: Copyright (c) 2017 InComm Agent Solutions, Inc All Rights Reserved
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2A5EAD8B41A7CDDC126B10ED248A2EEFEDA855660342F222A38CC6605D443E22
    SPKI SHA256: 82345A9F8E5D16895F1396AD533139611CA244FF9499EDBC8EEB4919AE05E764
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.41209.509.1.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:.incommagentsolutions.biz","email:.incommagentsolutions.com","email:.miestrella123.com","email:.miestrella123.net","email:.mystar123.com","email:.polandunlimited.com","email:.qpay123.biz","email:.qpay123.com","email:.qpaybi.com","email:.qpaynet.com","email:.qpayreport.com","email:.qpayreporting.com","email:.sinlimitemexico.com","email:incommagentsolutions.biz","email:incommagentsolutions.com","email:miestrella123.com","email:miestrella123.net","email:mystar123.com","email:polandunlimited.com","email:qpay123.biz","email:qpay123.com","email:qpaybi.com","email:qpaynet.com","email:qpayreport.com","email:qpayreporting.com","email:sinlimitemexico.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Intertek Document Signing Authority

- Subject: countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 75A8B9BC500AE2C194516E6FA12B85E5
- SHA-256: 9571BFEA2F1F572EEE34F9EE99F5E55CC7A2EC3A1B4B52B7C32A228482B6CC57
- SPKI SHA-256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
- Validity: 2019-08-21 to 2020-08-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:b9:bc:50:0a:e2:c1:94:51:6e:6f:a1:2b:85:e5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Aug 21 00:00:00 2019 GMT
            Not After : Aug  1 00:00:00 2020 GMT
        Subject: C = GB, O = Intertek Group plc, CN = Intertek Document Signing Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:A3:BC:5C:0E:D6:B5:08:6B:78:32:80:85:EF:00:08:84:80:86:C0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:intertek.com
                  DirName:C = GB, O = Intertek Group plc
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9571BFEA2F1F572EEE34F9EE99F5E55CC7A2EC3A1B4B52B7C32A228482B6CC57
    SPKI SHA256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Intertek Document Signing Authority

- Subject: countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 751E3F425BB83F47D2951D2AC4D117F4
- SHA-256: 91F4860A68760E55F4F2158478E67F958BD637B7C0FB6093E9E904DFA46AC334
- SPKI SHA-256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
- Validity: 2019-05-15 to 2021-05-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:42:5b:b8:3f:47:d2:95:1d:2a:c4:d1:17:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : May 15 00:00:00 2021 GMT
        Subject: C = GB, O = Intertek Group plc, CN = Intertek Document Signing Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:A3:BC:5C:0E:D6:B5:08:6B:78:32:80:85:EF:00:08:84:80:86:C0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:intertek.com
                  DirName:C = GB, O = Intertek Group plc
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91F4860A68760E55F4F2158478E67F958BD637B7C0FB6093E9E904DFA46AC334
    SPKI SHA256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Intertek Document Signing Authority

- Subject: countryName=GB, organizationName=Intertek Group plc, commonName=Intertek Document Signing Authority
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 751E3F522C9496D1AACFA907F8B78EDA
- SHA-256: 3659F59958D4FE8418668CFD949813DFC6F5D7BF5AD3893EC1ABA3D3B264A224
- SPKI SHA-256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
- Validity: 2019-06-12 to 2019-09-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:52:2c:94:96:d1:aa:cf:a9:07:f8:b7:8e:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jun 12 00:00:00 2019 GMT
            Not After : Sep  1 00:00:00 2019 GMT
        Subject: C = GB, O = Intertek Group plc, CN = Intertek Document Signing Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:A3:BC:5C:0E:D6:B5:08:6B:78:32:80:85:EF:00:08:84:80:86:C0
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:intertek.com
                  DirName:O = Intertek Group plc
                  DirName:C = GB, O = Intertek Group plc
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3659F59958D4FE8418668CFD949813DFC6F5D7BF5AD3893EC1ABA3D3B264A224
    SPKI SHA256: 607C5BEF2A97B19A39F77B508BB96697E51B218059FA746772BC26CADEF3FE35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### itsme Sign Biometric CA 2025

- Subject: countryName=BE, organizationName=Belgian Mobile ID, commonName=itsme Sign Biometric CA 2025, organizationIdentifier=NTRBE-0541659084
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 844358C581A978929521E9D434AB1332
- SHA-256: 05B0258EC83AD20E230A45068E2C821C1C48BF793B32C3D7596D87544F0C1B68
- SPKI SHA-256: 33531EF5048BA5A1528615639F833FFB334E3627F35F39C074D73ECE83905037
- Validity: 2025-09-17 to 2035-09-17
- Key: EC 521 secp521r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/itsmesignbiometricca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:c5:81:a9:78:92:95:21:e9:d4:34:ab:13:32
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Sep 17 02:56:38 2025 GMT
            Not After : Sep 17 00:00:00 2035 GMT
        Subject: C = BE, O = Belgian Mobile ID, CN = itsme Sign Biometric CA 2025, organizationIdentifier = NTRBE-0541659084
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (521 bit)
                ASN1 OID: secp521r1
                NIST CURVE: P-521
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A4:49:59:6B:58:AC:79:80:A2:7C:86:F0:59:A6:C8:8E:5D:52:AF:90
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 05B0258EC83AD20E230A45068E2C821C1C48BF793B32C3D7596D87544F0C1B68
    SPKI SHA256: 33531EF5048BA5A1528615639F833FFB334E3627F35F39C074D73ECE83905037
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### itsme Sign Non-Biometric CA 2025

- Subject: countryName=BE, organizationName=Belgian Mobile ID, commonName=itsme Sign Non-Biometric CA 2025, organizationIdentifier=NTRBE-0541659084
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Document Signing Root E45
- Serial: 844358CE0778E78B57D5496855301CB0
- SHA-256: 84D62224525C18A2ACCC844196572B80ADA245C5E5D1F9F3AD0E186A6FB9619C
- SPKI SHA-256: B22C7D5A6C07CC40D817E4D507660BE9D2E3724735F6324605A1D440366AE7B2
- Validity: 2025-09-17 to 2035-09-17
- Key: EC 521 secp521r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/itsmesignnonbiometricca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- CRL DP: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:43:58:ce:07:78:e7:8b:57:d5:49:68:55:30:1c:b0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Document Signing Root E45
        Validity
            Not Before: Sep 17 02:56:45 2025 GMT
            Not After : Sep 17 00:00:00 2035 GMT
        Subject: C = BE, O = Belgian Mobile ID, CN = itsme Sign Non-Biometric CA 2025, organizationIdentifier = NTRBE-0541659084
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (521 bit)
                ASN1 OID: secp521r1
                NIST CURVE: P-521
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9B:83:08:72:79:5E:42:98:2B:B2:1D:DA:39:FD:E3:F8:3A:8A:CF:71
            X509v3 Authority Key Identifier:
                61:99:02:B4:10:FF:10:3C:DB:7A:DA:6C:3A:70:24:03:60:F1:E7:8E
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/docsignroote45
                CA Issuers - URI:http://secure.globalsign.com/cacert/docsignroote45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/docsignroote45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 84D62224525C18A2ACCC844196572B80ADA245C5E5D1F9F3AD0E186A6FB9619C
    SPKI SHA256: B22C7D5A6C07CC40D817E4D507660BE9D2E3724735F6324605A1D440366AE7B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/docsignroote45
- AIA CA Issuers: http://secure.globalsign.com/cacert/docsignroote45.crt
- CRL Distribution Points: http://crl.globalsign.com/docsignroote45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JCAN GCC R6 Public CA1 - G5 2024

- Subject: countryName=JP, organizationName=GMO GlobalSign K.K., commonName=JCAN GCC R6 Public CA1 - G5 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 814E41EDBD4145808D6619A408AC20FC
- SHA-256: 4BFC1B87164F6EB0C0B68BA69093BE73E3F745F896CFD236B028BAA0E5321B39
- SPKI SHA-256: 19F24DF7CF9F249847D7A0911A0CA125460E59556EC09250DCA4E8CBD500737C
- Validity: 2024-06-19 to 2034-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/jcangccr6publicca1g52024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:4e:41:ed:bd:41:45:80:8d:66:19:a4:08:ac:20:fc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 19 03:24:38 2024 GMT
            Not After : Dec 10 00:00:00 2034 GMT
        Subject: C = JP, O = GMO GlobalSign K.K., CN = JCAN GCC R6 Public CA1 - G5 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1D:0B:5D:D0:BF:B8:91:48:07:C2:D9:8D:B1:68:5E:62:1C:B5:FF:76
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.20
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4BFC1B87164F6EB0C0B68BA69093BE73E3F745F896CFD236B028BAA0E5321B39
    SPKI SHA256: 19F24DF7CF9F249847D7A0911A0CA125460E59556EC09250DCA4E8CBD500737C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JCAN Public CA0

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0, commonName=JCAN Public CA0
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 0400000000012BCE328ECF
- SHA-256: E1FA5C97C7C6CAD191EEA3150EC225B87D2737248EF8F4F617D63B046D490F3C
- SPKI SHA-256: E7A6EC3451CF9F81099EA8A21DC278EE57C8AF749CD7730B3E05437BB6798094
- Validity: 2010-10-21 to 2020-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2b:ce:32:8e:cf
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Oct 21 10:00:00 2010 GMT
            Not After : Nov 21 10:00:00 2020 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA0, CN = JCAN Public CA0
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                55:07:98:6F:E0:48:B1:26:F1:E9:D7:DC:4F:47:CF:D0:A9:79:AF:DA
            X509v3 Certificate Policies:
                Policy: 1.2.392.200063.30.5300
                  CPS: http://www.jipdec.or.jp/repository/
                  User Notice:
                    Explicit Text: JCAN Business CP
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E1FA5C97C7C6CAD191EEA3150EC225B87D2737248EF8F4F617D63B046D490F3C
    SPKI SHA256: E7A6EC3451CF9F81099EA8A21DC278EE57C8AF749CD7730B3E05437BB6798094
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA0 - G2

- Subject: countryName=JP, organizationName=JIPDEC, commonName=JCAN Public CA0 - G2
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 0400000000012F4EE14DC6
- SHA-256: 2643C87E8B8FDB7C3F65B06F316A8E44AD0864C554EA4001EA9F57A5E264EF0C
- SPKI SHA-256: FF5C258A4F0BF541E255B59DFDF5F4EF036546AAF2EAC0A4AEF8EB79E50E3E3C
- Validity: 2011-04-13 to 2021-05-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:4d:c6
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : May 13 10:00:00 2021 GMT
        Subject: C = JP, O = JIPDEC, CN = JCAN Public CA0 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                30:B3:3A:B3:AA:A3:ED:4B:8D:2F:6C:F1:44:52:E6:60:33:84:19:85
            X509v3 Certificate Policies:
                Policy: 1.2.392.200063.30.5300
                  CPS: https://www.jipdec.or.jp/repository/
                  User Notice:
                    Explicit Text: JCAN Business CP
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2643C87E8B8FDB7C3F65B06F316A8E44AD0864C554EA4001EA9F57A5E264EF0C
    SPKI SHA256: FF5C258A4F0BF541E255B59DFDF5F4EF036546AAF2EAC0A4AEF8EB79E50E3E3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA0 - G3

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0 - G3, commonName=JCAN Public CA0 - G3
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 040000000001331BD0AAA3
- SHA-256: 59B69B0DE73B0209A7CE146DBCEA01B096E92513477EBE60409DACE88B6DF7D9
- SPKI SHA-256: FF5C258A4F0BF541E255B59DFDF5F4EF036546AAF2EAC0A4AEF8EB79E50E3E3C
- Validity: 2011-10-19 to 2022-11-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:1b:d0:aa:a3
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Oct 19 10:00:00 2011 GMT
            Not After : Nov 19 10:00:00 2022 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA0 - G3, CN = JCAN Public CA0 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                30:B3:3A:B3:AA:A3:ED:4B:8D:2F:6C:F1:44:52:E6:60:33:84:19:85
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.jipdec.or.jp/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 59B69B0DE73B0209A7CE146DBCEA01B096E92513477EBE60409DACE88B6DF7D9
    SPKI SHA256: FF5C258A4F0BF541E255B59DFDF5F4EF036546AAF2EAC0A4AEF8EB79E50E3E3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA0 - G3

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA0 - G3, commonName=JCAN Public CA0 - G3
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 04000000000133A75AF9E4
- SHA-256: 39883AFF3D0A0A401A9B84C0B830B95AFEC82AF371D9DC5D0219EA8A3DB4CF81
- SPKI SHA-256: 85A4324582C727603FC662C3C498D703A05B924B6C85DD8AD261765C37405953
- Validity: 2011-11-15 to 2022-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:a7:5a:f9:e4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Nov 15 10:00:00 2011 GMT
            Not After : Dec 15 10:00:00 2022 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA0 - G3, CN = JCAN Public CA0 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:61:96:9E:3F:B8:42:4C:39:82:29:22:97:92:EA:13:56:FF:88:16
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.jipdec.or.jp/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 39883AFF3D0A0A401A9B84C0B830B95AFEC82AF371D9DC5D0219EA8A3DB4CF81
    SPKI SHA256: 85A4324582C727603FC662C3C498D703A05B924B6C85DD8AD261765C37405953
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA1

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1, commonName=JCAN Public CA1
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 0400000000012BCE3291CD
- SHA-256: F1AB3972D0670890BFEC4A1C0993626A7574BA3E0155729FB6E759DEA4D1AA91
- SPKI SHA-256: F7BBB060655581576AE420505D17762806C41F1222F2DD7C691EE032CCF77F24
- Validity: 2010-10-21 to 2020-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2b:ce:32:91:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Oct 21 10:00:00 2010 GMT
            Not After : Nov 21 10:00:00 2020 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA1, CN = JCAN Public CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                30:83:EA:C3:69:1E:8A:24:A9:F1:7D:8C:D5:72:29:15:3C:2F:1B:CF
            X509v3 Certificate Policies:
                Policy: 1.2.392.200063.30.5300
                  CPS: http://www.jipdec.or.jp/repository/
                  User Notice:
                    Explicit Text: JCAN Business CP
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1AB3972D0670890BFEC4A1C0993626A7574BA3E0155729FB6E759DEA4D1AA91
    SPKI SHA256: F7BBB060655581576AE420505D17762806C41F1222F2DD7C691EE032CCF77F24
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA1 - G2

- Subject: countryName=JP, organizationName=JIPDEC, commonName=JCAN Public CA1 - G2
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 0400000000012F4EE15018
- SHA-256: 9EDF18512FD1269DCA691F3DF36B481CC99E3CF89ADF5613010F09C0E5EBD9EC
- SPKI SHA-256: 0AE02CC776D358AAC48B1CB1A745598E436566A5D46E0008FE11D5F7B9D042D2
- Validity: 2011-04-13 to 2021-05-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:50:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : May 13 10:00:00 2021 GMT
        Subject: C = JP, O = JIPDEC, CN = JCAN Public CA1 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                28:52:CE:A3:4E:2C:31:1F:3A:8D:EB:18:89:27:5F:A6:05:D7:50:1E
            X509v3 Certificate Policies:
                Policy: 1.2.392.200063.30.5300
                  CPS: https://www.jipdec.or.jp/repository/
                  User Notice:
                    Explicit Text: JCAN Business CP
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9EDF18512FD1269DCA691F3DF36B481CC99E3CF89ADF5613010F09C0E5EBD9EC
    SPKI SHA256: 0AE02CC776D358AAC48B1CB1A745598E436566A5D46E0008FE11D5F7B9D042D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200063.30.5300
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA1 - G3

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G3, commonName=JCAN Public CA1 - G3
- Issuer: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Serial: 040000000001331BD0AEC9
- SHA-256: 91E98D0947C125494EAAF2A38D087BE0781AF20D8A14EE8C39FECDC482CF5F82
- SPKI SHA-256: F55B9C3F5D3786C2C0DCEEBE61D32CD176FE11B7F6786FBE17B6558027BE07BC
- Validity: 2011-10-19 to 2022-11-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:1b:d0:ae:c9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Validity
            Not Before: Oct 19 10:00:00 2011 GMT
            Not After : Nov 19 10:00:00 2022 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA1 - G3, CN = JCAN Public CA1 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C1:2A:30:82:A2:39:FA:1B:DB:6D:84:3B:33:06:96:91:CB:3D:D7:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.jipdec.or.jp/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/jcansubrootca0.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
            X509v3 Authority Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91E98D0947C125494EAAF2A38D087BE0781AF20D8A14EE8C39FECDC482CF5F82
    SPKI SHA256: F55B9C3F5D3786C2C0DCEEBE61D32CD176FE11B7F6786FBE17B6558027BE07BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/jcan/jcansubrootca0.crt
- CRL Distribution Points: http://crl.globalsign.net/jcansubrootca0.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### JCAN Public CA1 - G4

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G4, commonName=JCAN Public CA1 - G4
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 48F5B3838F0860A439497F00010D
- SHA-256: 7B464DC384FDB1A525C2CC279ED0C7CFAD24BECF72C46A7D7093D157C217607E
- SPKI SHA-256: DED3193C6B272963ED5E1098E7B12AC44A5F6783E3A0252AD4B2D68E1306F48F
- Validity: 2017-02-22 to 2027-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:f5:b3:83:8f:08:60:a4:39:49:7f:00:01:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 22 00:00:00 2017 GMT
            Not After : Feb 22 00:00:00 2027 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA1 - G4, CN = JCAN Public CA1 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B9:8E:CD:F1:EC:7A:2E:9C:B9:EB:6F:0B:1C:C4:D4:AC:19:AE:A1:54
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7B464DC384FDB1A525C2CC279ED0C7CFAD24BECF72C46A7D7093D157C217607E
    SPKI SHA256: DED3193C6B272963ED5E1098E7B12AC44A5F6783E3A0252AD4B2D68E1306F48F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### JCAN Public CA1 - G4

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Public CA1 - G4, commonName=JCAN Public CA1 - G4
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root nonTLS CA SHA256 G3
- Serial: 77BD0D7C66775FF970BBD06983A66B58
- SHA-256: 9AC4C8E358C095C998122ADD17A336C0AC597ECBECB7EDC3F58A75040CF94A5F
- SPKI SHA-256: DED3193C6B272963ED5E1098E7B12AC44A5F6783E3A0252AD4B2D68E1306F48F
- Validity: 2020-07-05 to 2027-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/jcanpublicca1g4.crl, http://crl.globalsign.com/gs/jcanpublicca1g4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustrootnontlssha2g3
- CRL DP: http://crl.globalsign.com/trustrootnontlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:7c:66:77:5f:f9:70:bb:d0:69:83:a6:6b:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root nonTLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Feb 22 00:00:00 2027 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Public CA1 - G4, CN = JCAN Public CA1 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B9:8E:CD:F1:EC:7A:2E:9C:B9:EB:6F:0B:1C:C4:D4:AC:19:AE:A1:54
            X509v3 Authority Key Identifier:
                29:F1:5C:83:62:5B:F7:3F:1C:D6:12:05:2B:49:A0:9B:26:AB:B3:99
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustrootnontlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootnontlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootnontlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.20
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9AC4C8E358C095C998122ADD17A336C0AC597ECBECB7EDC3F58A75040CF94A5F
    SPKI SHA256: DED3193C6B272963ED5E1098E7B12AC44A5F6783E3A0252AD4B2D68E1306F48F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.20
- AIA OCSP: http://ocsp.globalsign.com/trustrootnontlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootnontlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootnontlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### JCAN Sub Root CA0

- Subject: countryName=JP, organizationName=JIPDEC, organizationalUnitName=JCAN Sub Root CA0, commonName=JCAN Sub Root CA0
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012BCE328A6A
- SHA-256: 8FA602FFF590DF583A36D509C265F6C3EA8C34A9D56CFF86285FBFE9936BFC55
- SPKI SHA-256: 234D8FFC7EF8023C818BF19F47894186D7B2E75643280D96F9F39965289DE15E
- Validity: 2010-10-21 to 2028-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2b:ce:32:8a:6a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Oct 21 10:00:00 2010 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = JP, O = JIPDEC, OU = JCAN Sub Root CA0, CN = JCAN Sub Root CA0
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                6D:89:53:FA:D2:FA:68:2A:75:6D:A6:5F:B2:86:28:03:6C:50:29:3E
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8FA602FFF590DF583A36D509C265F6C3EA8C34A9D56CFF86285FBFE9936BFC55
    SPKI SHA256: 234D8FFC7EF8023C818BF19F47894186D7B2E75643280D96F9F39965289DE15E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_http_urls
- has_crldp

### Jo Tankers CA

- Subject: emailAddress=jotca@jotankers.com, countryName=NO, stateOrProvinceName=Hordaland, localityName=Bergen, organizationName=Jo Tankers, commonName=Jo Tankers CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000011E4487952A
- SHA-256: 862B5159BEE6A6D337F2B82E49800C2176D55F72BDA4EECDD8DAA405A83AB454
- SPKI SHA-256: FEA3E6890541F0986DE76C5DE75E5C5A586E973B04B71753CFD28A7575567CFC
- Validity: 2008-12-17 to 2018-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1e:44:87:95:2a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec 17 12:00:00 2008 GMT
            Not After : Dec 17 12:00:00 2018 GMT
        Subject: emailAddress = jotca@jotankers.com, C = NO, ST = Hordaland, L = Bergen, O = Jo Tankers, CN = Jo Tankers CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                EE:AB:86:53:94:A7:AF:36:2E:A0:EF:5C:78:69:CD:BB:B1:49:E4:AA
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 862B5159BEE6A6D337F2B82E49800C2176D55F72BDA4EECDD8DAA405A83AB454
    SPKI SHA256: FEA3E6890541F0986DE76C5DE75E5C5A586E973B04B71753CFD28A7575567CFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Keysec GR3 DV TLS CA 2024

- Subject: countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 DV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80B6D3F52760EDCD23026BD36BE487FB
- SHA-256: F03655CFE85B3A3F2AF2FD37CAB9EA283B3A28A9B6157FE9BEB75C17C0611B3A
- SPKI SHA-256: ADEE221C341515E1206457DA925D88845F393FE0E02D36F37CE577EAEE05DC55
- Validity: 2024-03-20 to 2027-03-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/keysecgr3dvtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:b6:d3:f5:27:60:ed:cd:23:02:6b:d3:6b:e4:87:fb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 20 03:20:05 2024 GMT
            Not After : Mar 20 00:00:00 2027 GMT
        Subject: C = BR, O = KEYSEC LTDA, CN = Keysec GR3 DV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                06:13:81:20:9F:98:CB:A1:35:5C:B1:6C:AA:B1:75:EA:0E:FB:7E:1D
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F03655CFE85B3A3F2AF2FD37CAB9EA283B3A28A9B6157FE9BEB75C17C0611B3A
    SPKI SHA256: ADEE221C341515E1206457DA925D88845F393FE0E02D36F37CE577EAEE05DC55
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Keysec GR3 EV TLS CA 2024

- Subject: countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 EV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80B6D4036B9FC4298137B660C87AF9D0
- SHA-256: 9173EFAEA4E61855EB858D107DBA94A1CD18CAE00EAF9C7EDB57201AD99A9BFD
- SPKI SHA-256: E73776671C9B1046529579617329E6A5606E49295235BF8BDA1C9FD621FE5955
- Validity: 2024-03-20 to 2027-03-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/keysecgr3evtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:b6:d4:03:6b:9f:c4:29:81:37:b6:60:c8:7a:f9:d0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 20 03:20:16 2024 GMT
            Not After : Mar 20 00:00:00 2027 GMT
        Subject: C = BR, O = KEYSEC LTDA, CN = Keysec GR3 EV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FC:DC:DE:0C:EF:7A:33:38:61:00:CA:C8:64:31:16:BF:00:29:52:00
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9173EFAEA4E61855EB858D107DBA94A1CD18CAE00EAF9C7EDB57201AD99A9BFD
    SPKI SHA256: E73776671C9B1046529579617329E6A5606E49295235BF8BDA1C9FD621FE5955
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Keysec GR3 OV TLS CA 2024

- Subject: countryName=BR, organizationName=KEYSEC LTDA, commonName=Keysec GR3 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 80B6D3FFCEE8906775B7AEC78AE12CEA
- SHA-256: 8AFDA1ED73BF375DC6E097DB871BBFE4CEB68E61381C39BDF6A4576DC171BFB2
- SPKI SHA-256: 7DFCACC034D1A5DCA458862540F0E9440E5515327AA26687C64E56EBD8CEF090
- Validity: 2024-03-20 to 2027-03-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/keysecgr3ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:b6:d3:ff:ce:e8:90:67:75:b7:ae:c7:8a:e1:2c:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Mar 20 03:20:13 2024 GMT
            Not After : Mar 20 00:00:00 2027 GMT
        Subject: C = BR, O = KEYSEC LTDA, CN = Keysec GR3 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2E:0A:55:90:DA:4A:22:70:9B:B9:A2:C8:67:B4:FD:4A:C0:94:58:33
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8AFDA1ED73BF375DC6E097DB871BBFE4CEB68E61381C39BDF6A4576DC171BFB2
    SPKI SHA256: 7DFCACC034D1A5DCA458862540F0E9440E5515327AA26687C64E56EBD8CEF090
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### LinQuest GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9CCA4ED322B426BD284E7CF89A
- SHA-256: DDD73ABF0259F18F77CA598C2745EA18243526B10D371D7E3B088D68C88C0A97
- SPKI SHA-256: 3F5FE991F02522EB8CD1F6FDA85273AA585DFA22DB18D582009B413644797405
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/linquestgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9c:ca:4e:d3:22:b4:26:bd:28:4e:7c:f8:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = LinQuest Corporation, CN = LinQuest GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:EB:21:21:9A:C9:BE:D2:8A:4D:51:1A:BA:8F:03:35:99:1D:AE:49
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DDD73ABF0259F18F77CA598C2745EA18243526B10D371D7E3B088D68C88C0A97
    SPKI SHA256: 3F5FE991F02522EB8CD1F6FDA85273AA585DFA22DB18D582009B413644797405
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LinQuest GCC R3 SMIME CA 2020

- Subject: countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest GCC R3 SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC36F772F7306E16440D3591CF3624
- SHA-256: 7BB16E460DFF6DBC33D941D5552D494B71E776B79FFDE7A5C0413F64A768931E
- SPKI SHA-256: 3F5FE991F02522EB8CD1F6FDA85273AA585DFA22DB18D582009B413644797405
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/linquestgccr3smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:36:f7:72:f7:30:6e:16:44:0d:35:91:cf:36:24
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:30:11 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = LinQuest Corporation, CN = LinQuest GCC R3 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:EB:21:21:9A:C9:BE:D2:8A:4D:51:1A:BA:8F:03:35:99:1D:AE:49
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7BB16E460DFF6DBC33D941D5552D494B71E776B79FFDE7A5C0413F64A768931E
    SPKI SHA256: 3F5FE991F02522EB8CD1F6FDA85273AA585DFA22DB18D582009B413644797405
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LinQuest SMIME CA 2020

- Subject: countryName=US, organizationName=LinQuest Corporation, commonName=LinQuest SMIME CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE3142297C56589CBC183738E54D
- SHA-256: 113138DD7B216725840238E2D7EEECB3738DB139064B24CB853FC270A49E6057
- SPKI SHA-256: 3936CD1BD72D22AF5F2DC3562CA37EE933C23712885ED7B3C7772F5BE54D8D3C
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:31:42:29:7c:56:58:9c:bc:18:37:38:e5:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = US, O = LinQuest Corporation, CN = LinQuest SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:C5:5A:B5:B3:4A:13:F5:10:65:3D:80:D5:4A:14:2E:98:99:34:FC
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 113138DD7B216725840238E2D7EEECB3738DB139064B24CB853FC270A49E6057
    SPKI SHA256: 3936CD1BD72D22AF5F2DC3562CA37EE933C23712885ED7B3C7772F5BE54D8D3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### LSU Health System CA

- Subject: countryName=US, stateOrProvinceName=Louisiana, localityName=Shreveport, organizationalUnitName=IT Security and Policy Group, organizationName=LSU Health System, commonName=LSU Health System CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 39804A831107A56FFC5C6006025BC9C8C0
- SHA-256: 049ABF7637BBBEC8A6C3AC3D0B6E99D8E17B61D204E07B37982010CEA61E852A
- SPKI SHA-256: BCDB44D9BBA8ECC53521FD29F167A3FE51F44386F0DD2CD47FD8FC47E73CC4CA
- Validity: 2012-10-11 to 2017-10-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:80:4a:83:11:07:a5:6f:fc:5c:60:06:02:5b:c9:c8:c0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Oct 11 00:00:00 2012 GMT
            Not After : Oct 11 00:00:00 2017 GMT
        Subject: C = US, ST = Louisiana, L = Shreveport, OU = IT Security and Policy Group, O = LSU Health System, CN = LSU Health System CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Name Constraints:
                Permitted:
                  DNS:lsuhsc.edu
                  DNS:lsuhscshreveport.edu
                  DNS:lsuhealthsystem.org
                  DNS:lsuhealthshreveport.org
                  email:lsuhsc.edu
                  email:lsuhscshreveport.edu
                  email:lsuhealthsystem.org
                  email:lsuhealthshreveport.org
                  DirName:C = US, ST = Louisiana, L = Shreveport, O = LSU Health System
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                6D:7F:88:97:9B:AB:01:4E:49:59:6C:DB:7D:70:12:77:8A:71:02:F2
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 049ABF7637BBBEC8A6C3AC3D0B6E99D8E17B61D204E07B37982010CEA61E852A
    SPKI SHA256: BCDB44D9BBA8ECC53521FD29F167A3FE51F44386F0DD2CD47FD8FC47E73CC4CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Mobile Armor Enterprise CA

- Subject: commonName=Mobile Armor Enterprise CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000118C1A37ED6
- SHA-256: 3A44DCE26754075C76177C6C5016B6C1A80864B5BE4D8025F34817C726F020D1
- SPKI SHA-256: 58DFF44299F91FA846EF2C559CC189EB5AEDD220BB746D3942181B6C343166B3
- Validity: 2008-03-18 to 2018-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:18:c1:a3:7e:d6
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Mar 18 12:00:00 2008 GMT
            Not After : Mar 18 12:00:00 2018 GMT
        Subject: CN = Mobile Armor Enterprise CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                86:70:9E:CE:2E:CD:77:4B:5F:AC:43:45:75:33:16:06:71:58:CE:E8
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3A44DCE26754075C76177C6C5016B6C1A80864B5BE4D8025F34817C726F020D1
    SPKI SHA256: 58DFF44299F91FA846EF2C559CC189EB5AEDD220BB746D3942181B6C343166B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### MSC Trustgate.com RSA AATL CA 2019

- Subject: countryName=MY, organizationName=MSC Trustgate.com Sdn. Bhd., organizationalUnitName=MyTrust Gateway, commonName=MSC Trustgate.com RSA AATL CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01F240410BF98509385F57D41D
- SHA-256: 3A882530C03EA615E5EF4DADBD7C8660912FA93FAF5088716FB46A8E1FFA9218
- SPKI SHA-256: 15267F6C373D6F2C3D1BBC37BD2786CC7BE7174220E75ECEE94F23105F2CCE64
- Validity: 2019-01-16 to 2024-01-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30.2, 1.3.6.1.4.1.49530.1.1.2.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:41:0b:f9:85:09:38:5f:57:d4:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jan 16 00:00:00 2019 GMT
            Not After : Jan 16 00:00:00 2024 GMT
        Subject: C = MY, O = MSC Trustgate.com Sdn. Bhd., OU = MyTrust Gateway, CN = MSC Trustgate.com RSA AATL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EB:AE:6B:85:2F:70:10:16:EC:28:59:5C:A4:3D:B7:7A:74:31:A9:6E
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30.2
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.49530.1.1.2.3
                  CPS: https://www.msctrustgate.com/tgcps
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3A882530C03EA615E5EF4DADBD7C8660912FA93FAF5088716FB46A8E1FFA9218
    SPKI SHA256: 15267F6C373D6F2C3D1BBC37BD2786CC7BE7174220E75ECEE94F23105F2CCE64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing, 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30.2, 1.3.6.1.4.1.49530.1.1.2.3
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NAESB GCC R45 Client Authentication CA 2020

- Subject: countryName=US, organizationName=GMO GlobalSign Inc., commonName=NAESB GCC R45 Client Authentication CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 7803185CFEB555E938D680585EDBD49A
- SHA-256: 5EBD04144508FADD1B9DB79FF62B826D6FF893987B1534C0F8EEC2261D6AC452
- SPKI SHA-256: A1F63BF1418C07BFFF902F1BA1FA1C7233CA4F9EE4F37A2F6E567AF1DEA1735D
- Validity: 2020-07-28 to 2026-07-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/naesbgccr45clientauthca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:5c:fe:b5:55:e9:38:d6:80:58:5e:db:d4:9a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2026 GMT
        Subject: C = US, O = GMO GlobalSign Inc., CN = NAESB GCC R45 Client Authentication CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                31:4D:78:01:35:2C:A4:1C:51:90:10:A3:7D:C3:AE:C8:21:F4:4F:1C
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5EBD04144508FADD1B9DB79FF62B826D6FF893987B1534C0F8EEC2261D6AC452
    SPKI SHA256: A1F63BF1418C07BFFF902F1BA1FA1C7233CA4F9EE4F37A2F6E567AF1DEA1735D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NAESB GCC R45 Client Authentication CA 2024

- Subject: countryName=US, organizationName=GMO GlobalSign, Inc., commonName=NAESB GCC R45 Client Authentication CA 2024
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 80E56B0C4EA6CECA7EF6A68637E6BC00
- SHA-256: 1AA7F7FB618CFC8E6EE7D12E2EEE826D3ED4A22F39EC21C9D2A5A0C40AE6BF92
- SPKI SHA-256: 5ABE860C3A68FD0CE8EFBCB8A490BD0E0D4FCD7C58DF3D5FCD1C2AFB60C6D1B9
- Validity: 2024-04-17 to 2030-04-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/naesbgccr45clientauthca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:e5:6b:0c:4e:a6:ce:ca:7e:f6:a6:86:37:e6:bc:00
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Apr 17 03:18:26 2024 GMT
            Not After : Apr 17 00:00:00 2030 GMT
        Subject: C = US, O = "GMO GlobalSign, Inc.", CN = NAESB GCC R45 Client Authentication CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E1:D0:71:3C:F8:6A:30:91:04:41:8A:75:8B:6C:9A:D1:68:21:AA:E9
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1AA7F7FB618CFC8E6EE7D12E2EEE826D3ED4A22F39EC21C9D2A5A0C40AE6BF92
    SPKI SHA256: 5ABE860C3A68FD0CE8EFBCB8A490BD0E0D4FCD7C58DF3D5FCD1C2AFB60C6D1B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NAESB Issuing CA - SHA256 - G2

- Subject: countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 05B96B0DE357F87B41ACA1B0D01E2B6A15
- SHA-256: 00517E8B0D545362FF61C986C9B316280A8154851DC4676A49191DDD1C7E5BA6
- SPKI SHA-256: 1008DE220D806E8D2B3CB3939960E917CED9C58B47A1AE7DE45BCCCED1CDF18C
- Validity: 2012-11-13 to 2018-11-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:b9:6b:0d:e3:57:f8:7b:41:ac:a1:b0:d0:1e:2b:6a:15
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Nov 12 23:59:59 2018 GMT
        Subject: C = US, ST = New Hampshire, L = Portsmouth, O = GMO GlobalSign Inc., CN = NAESB Issuing CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2ocsp.crt
            X509v3 Subject Key Identifier:
                7E:CA:00:B2:D3:88:40:FF:1D:BB:2D:1A:3B:99:14:15:AF:B5:8C:ED
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 00517E8B0D545362FF61C986C9B316280A8154851DC4676A49191DDD1C7E5BA6
    SPKI SHA256: 1008DE220D806E8D2B3CB3939960E917CED9C58B47A1AE7DE45BCCCED1CDF18C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2ocsp.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NAESB Issuing CA - SHA256 - G2

- Subject: countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA256 - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 5C76B72835BB871D2A81B65EA01AE1A832
- SHA-256: 9FF9C8907090B52DBAA573B4D25FEE8673D8B27C72245BF2FF7E95543E72F5CA
- SPKI SHA-256: 1008DE220D806E8D2B3CB3939960E917CED9C58B47A1AE7DE45BCCCED1CDF18C
- Validity: 2012-11-13 to 2018-11-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:76:b7:28:35:bb:87:1d:2a:81:b6:5e:a0:1a:e1:a8:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Nov 12 23:59:59 2018 GMT
        Subject: C = US, ST = New Hampshire, L = Portsmouth, O = GMO GlobalSign Inc., CN = NAESB Issuing CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 Subject Key Identifier:
                7E:CA:00:B2:D3:88:40:FF:1D:BB:2D:1A:3B:99:14:15:AF:B5:8C:ED
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9FF9C8907090B52DBAA573B4D25FEE8673D8B27C72245BF2FF7E95543E72F5CA
    SPKI SHA256: 1008DE220D806E8D2B3CB3939960E917CED9C58B47A1AE7DE45BCCCED1CDF18C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### NAESB Issuing CA - SHA384 - G3

- Subject: countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 47C310523D5349CDDDE96B8EF27F
- SHA-256: 0986B5A1C7314EFB04FB648B9E2B57CF4842FD1D4345D28E52094C90A9FECBFE
- SPKI SHA-256: 2D5FCBA7AD06A417CD3E5508352A1FF6A7A77728F922987C85A34AB782ACD4E5
- Validity: 2016-05-18 to 2022-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:10:52:3d:53:49:cd:dd:e9:6b:8e:f2:7f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: May 18 00:00:00 2016 GMT
            Not After : May 18 00:00:00 2022 GMT
        Subject: C = US, ST = New Hampshire, L = Portsmouth, O = GMO GlobalSign Inc., CN = NAESB Issuing CA - SHA384 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                14:55:0A:68:59:E1:90:6E:D3:48:8A:F3:E7:7F:21:9F:1E:EA:71:B4
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0986B5A1C7314EFB04FB648B9E2B57CF4842FD1D4345D28E52094C90A9FECBFE
    SPKI SHA256: 2D5FCBA7AD06A417CD3E5508352A1FF6A7A77728F922987C85A34AB782ACD4E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### NAESB Issuing CA - SHA384 - G3

- Subject: countryName=US, stateOrProvinceName=New Hampshire, localityName=Portsmouth, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G3
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 7653FE5927EFF8898C6170A14CC6D975
- SHA-256: 128DED1A8AD60C24B4254E31DB94FC4392BF93ED5434472AA43A0B9856106068
- SPKI SHA-256: 2D5FCBA7AD06A417CD3E5508352A1FF6A7A77728F922987C85A34AB782ACD4E5
- Validity: 2020-01-22 to 2022-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:59:27:ef:f8:89:8c:61:70:a1:4c:c6:d9:75
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : May 18 00:00:00 2022 GMT
        Subject: C = US, ST = New Hampshire, L = Portsmouth, O = GMO GlobalSign Inc., CN = NAESB Issuing CA - SHA384 - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                14:55:0A:68:59:E1:90:6E:D3:48:8A:F3:E7:7F:21:9F:1E:EA:71:B4
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 128DED1A8AD60C24B4254E31DB94FC4392BF93ED5434472AA43A0B9856106068
    SPKI SHA256: 2D5FCBA7AD06A417CD3E5508352A1FF6A7A77728F922987C85A34AB782ACD4E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NAESB Issuing CA - SHA384 - G4

- Subject: countryName=US, organizationName=GMO GlobalSign Inc., commonName=NAESB Issuing CA - SHA384 - G4
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE2EA0972481B485EFF3B7F43260
- SHA-256: C4C7C436BD88E8E68DB00297DF83ACC819E198639BA00522C8E3245876898523
- SPKI SHA-256: B744C7069A3829109909AF7BDDCE26EE29639F3FA910592E62612B94D7BD86A3
- Validity: 2020-01-22 to 2026-01-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:2e:a0:97:24:81:b4:85:ef:f3:b7:f4:32:60
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Jan 22 00:00:00 2026 GMT
        Subject: C = US, O = GMO GlobalSign Inc., CN = NAESB Issuing CA - SHA384 - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                52:C0:AE:29:A2:39:97:17:CB:BD:3E:C9:49:55:E4:41:0E:3E:65:E1
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C4C7C436BD88E8E68DB00297DF83ACC819E198639BA00522C8E3245876898523
    SPKI SHA256: B744C7069A3829109909AF7BDDCE26EE29639F3FA910592E62612B94D7BD86A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, Microsoft Encrypted File System, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### NAU Offline Intermediate CA

- Subject: emailAddress=its-mensa@nau.edu, stateOrProvinceName=Arizona, organizationalUnitName=Information Technology Services, organizationName=Northern Arizona University, localityName=Flagstaff, countryName=US, commonName=NAU Offline Intermediate CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000127FB9F420F
- SHA-256: CF8A4AA88B6BF4F8E0010832A5545BB51CF04DBE59830998DA681B54EB8F4362
- SPKI SHA-256: DE61243C8528C57941406DE02D864E4B740F40EA117F2CF796DDCD1EE77EB09E
- Validity: 2009-11-25 to 2019-11-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:9f:42:0f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Nov 25 12:00:00 2009 GMT
            Not After : Nov 25 12:00:00 2019 GMT
        Subject: emailAddress = its-mensa@nau.edu, ST = Arizona, OU = Information Technology Services, O = Northern Arizona University, L = Flagstaff, C = US, CN = NAU Offline Intermediate CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                07:8F:0B:9B:2C:CE:70:EC:B9:C9:11:57:47:88:FA:7D:2E:17:CE:C4
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CF8A4AA88B6BF4F8E0010832A5545BB51CF04DBE59830998DA681B54EB8F4362
    SPKI SHA256: DE61243C8528C57941406DE02D864E4B740F40EA117F2CF796DDCD1EE77EB09E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### NAU Offline Intermediate CA

- Subject: emailAddress=its-mensa@nau.edu, stateOrProvinceName=Arizona, organizationalUnitName=Information Technology Services, organizationName=Northern Arizona University, localityName=Flagstaff, countryName=US, commonName=NAU Offline Intermediate CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000012596C45382
- SHA-256: 8F79461F1E6BBE216EFA8389141DDAD8E4CCE44734AB559281A1CC934C5BA9D4
- SPKI SHA-256: DE61243C8528C57941406DE02D864E4B740F40EA117F2CF796DDCD1EE77EB09E
- Validity: 2009-12-16 to 2019-12-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:96:c4:53:82
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Dec 16 09:00:00 2009 GMT
            Not After : Dec 16 09:00:00 2019 GMT
        Subject: emailAddress = its-mensa@nau.edu, ST = Arizona, OU = Information Technology Services, O = Northern Arizona University, L = Flagstaff, C = US, CN = NAU Offline Intermediate CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                07:8F:0B:9B:2C:CE:70:EC:B9:C9:11:57:47:88:FA:7D:2E:17:CE:C4
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8F79461F1E6BBE216EFA8389141DDAD8E4CCE44734AB559281A1CC934C5BA9D4
    SPKI SHA256: DE61243C8528C57941406DE02D864E4B740F40EA117F2CF796DDCD1EE77EB09E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### NCDOR SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=NC, organizationName=Department of Revenue, commonName=NCDOR SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E366784EEA6147A9F42E0D9C
- SHA-256: C647C537F7E3D280948D40800AEF8F534254F74A12168E3630E760D71675BE3B
- SPKI SHA-256: 92B423DB0BD9A785B9F22D96C5E411E9A8A75831849209E87F1E1ACFAEDC515A
- Validity: 2017-06-21 to 2022-06-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:66:78:4e:ea:61:47:a9:f4:2e:0d:9c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jun 21 00:00:00 2017 GMT
            Not After : Jun 21 00:00:00 2022 GMT
        Subject: C = US, ST = NC, O = Department of Revenue, CN = NCDOR SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:2B:5F:6A:2B:48:02:07:6F:A2:EC:B8:0B:AC:8F:F9:3B:80:6C:35
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C647C537F7E3D280948D40800AEF8F534254F74A12168E3630E760D71675BE3B
    SPKI SHA256: 92B423DB0BD9A785B9F22D96C5E411E9A8A75831849209E87F1E1ACFAEDC515A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Noble Energy SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=Noble Energy, Inc., commonName=Noble Energy SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 63185DDB639A93798122FC17D0155349FC
- SHA-256: AD4954416213AD019D53FD959B1F226130F2CC749CCFD43C079951D8AFC7BB41
- SPKI SHA-256: 1366A90623CC1BF669BE4F336F32ADE6C878B018F829A0148B641391CF17B1A3
- Validity: 2014-05-28 to 2020-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:18:5d:db:63:9a:93:79:81:22:fc:17:d0:15:53:49:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: May 28 00:00:00 2014 GMT
            Not After : Jun 27 00:00:00 2020 GMT
        Subject: C = US, ST = Texas, L = Houston, O = "Noble Energy, Inc.", CN = Noble Energy SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 Subject Key Identifier:
                81:EC:95:87:72:10:7C:E2:60:FB:AE:5E:69:1D:4A:CB:12:21:5D:C2
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD4954416213AD019D53FD959B1F226130F2CC749CCFD43C079951D8AFC7BB41
    SPKI SHA256: 1366A90623CC1BF669BE4F336F32ADE6C878B018F829A0148B641391CF17B1A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Noble Energy SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=Noble Energy, Inc., commonName=Noble Energy SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 4617C402D0CBA2A04606E1E5A7B6
- SHA-256: FA51FE39F0F316E92412E1170118E2D62A8E4ADA0F88EC237F3CE631F70BE298
- SPKI SHA-256: 1366A90623CC1BF669BE4F336F32ADE6C878B018F829A0148B641391CF17B1A3
- Validity: 2015-01-22 to 2020-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:17:c4:02:d0:cb:a2:a0:46:06:e1:e5:a7:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jan 22 00:00:00 2015 GMT
            Not After : Jun 27 00:00:00 2020 GMT
        Subject: C = US, ST = Texas, L = Houston, O = "Noble Energy, Inc.", CN = Noble Energy SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:EC:95:87:72:10:7C:E2:60:FB:AE:5E:69:1D:4A:CB:12:21:5D:C2
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA51FE39F0F316E92412E1170118E2D62A8E4ADA0F88EC237F3CE631F70BE298
    SPKI SHA256: 1366A90623CC1BF669BE4F336F32ADE6C878B018F829A0148B641391CF17B1A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### NSW-DET-INT-CA1

- Subject: countryName=AU, organizationName=Department of Education and Training, organizationalUnitName=ITD, commonName=NSW-DET-INT-CA1
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000012507408E29
- SHA-256: DCE44BAFEE25BF1BB34B6EB195D55AF46039AFF92EDBB9395F82B28FE4D20C5B
- SPKI SHA-256: D2F52BB6A9260BAF9EF3713CA6E9F295F8EC9928A7E9FDDEBBBEB539D491EF30
- Validity: 2009-11-18 to 2019-11-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:25:07:40:8e:29
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Nov 18 10:00:00 2009 GMT
            Not After : Nov 18 10:00:00 2019 GMT
        Subject: C = AU, O = Department of Education and Training, OU = ITD, CN = NSW-DET-INT-CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                CE:A7:01:92:D3:46:8A:95:B1:A7:DE:B5:E8:64:BF:20:EA:5C:BD:90
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DCE44BAFEE25BF1BB34B6EB195D55AF46039AFF92EDBB9395F82B28FE4D20C5B
    SPKI SHA256: D2F52BB6A9260BAF9EF3713CA6E9F295F8EC9928A7E9FDDEBBBEB539D491EF30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Osterreichischer Rundfunk Atlas R45 SMIME CA 2026

- Subject: countryName=AT, organizationName=Osterreichischer Rundfunk, commonName=Osterreichischer Rundfunk Atlas R45 SMIME CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8515039559A1679D8A6FCFDF1CF3FEFA
- SHA-256: 7C56B9A6E3E2EF8904AB2FCFAF33141C907ADDFE1EC10E9BDD4C9B02CEFC6D2D
- SPKI SHA-256: BC07228CEC1E4163FBBCFD0F1B2AC384E420C0CFF3293E7FE15F853702520D90
- Validity: 2026-01-21 to 2036-01-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/orfatlasr45smimeca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:15:03:95:59:a1:67:9d:8a:6f:cf:df:1c:f3:fe:fa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jan 21 02:59:03 2026 GMT
            Not After : Jan 21 00:00:00 2036 GMT
        Subject: C = AT, O = Osterreichischer Rundfunk, CN = Osterreichischer Rundfunk Atlas R45 SMIME CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:7D:A0:FB:4F:31:12:A8:EF:AA:EB:9B:58:20:A1:CE:C5:71:3D:A6
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7C56B9A6E3E2EF8904AB2FCFAF33141C907ADDFE1EC10E9BDD4C9B02CEFC6D2D
    SPKI SHA256: BC07228CEC1E4163FBBCFD0F1B2AC384E420C0CFF3293E7FE15F853702520D90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Pos Digicert Issuing CA

- Subject: countryName=MY, stateOrProvinceName=Selangor, localityName=Cyberjaya, organizationalUnitName=457608-K, organizationName=Pos Digicert Sdn Bhd, commonName=Pos Digicert Issuing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E707CDE1F486C97BFEC41758
- SHA-256: 5250ABD43D51DEF9D5EE6285FEF4F1A90841E06BF28E2F9125684D3ECCA735B2
- SPKI SHA-256: 10EF2125062C39F12E807DA4304BFF94D9F281180C892C5D6B996B414DCEBB4C
- Validity: 2017-12-06 to 2022-12-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40.30.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:cd:e1:f4:86:c9:7b:fe:c4:17:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec  6 00:00:00 2017 GMT
            Not After : Dec  6 00:00:00 2022 GMT
        Subject: C = MY, ST = Selangor, L = Cyberjaya, OU = 457608-K, O = Pos Digicert Sdn Bhd, CN = Pos Digicert Issuing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A3:E2:52:16:F4:F9:59:6C:43:76:F6:DD:77:C9:4C:90:DC:70:2C:2F
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                Policy: 1.3.6.1.4.1.4146.1.40.30.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5250ABD43D51DEF9D5EE6285FEF4F1A90841E06BF28E2F9125684D3ECCA735B2
    SPKI SHA256: 10EF2125062C39F12E807DA4304BFF94D9F281180C892C5D6B996B414DCEBB4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40.30.2
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Prodrive Technologies Atlas R46 OV TLS CA 2026

- Subject: countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies Atlas R46 OV TLS CA 2026
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 8537F4EA36B9AA56366F2EE9E2E23139
- SHA-256: 79DE64F790E6DFC7A65B0B5BB0DC4EF0AC835F9914C7A25E4455670282C1E73A
- SPKI SHA-256: 103237EEB0A6460BA55E406AC5423DBF7D7B84D5D837965CAF98EDECF92BEA6D
- Validity: 2026-02-11 to 2031-02-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/prodrivetechnologiesatlasr46ovtlsca2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            85:37:f4:ea:36:b9:aa:56:36:6f:2e:e9:e2:e2:31:39
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Feb 11 02:57:52 2026 GMT
            Not After : Feb 11 00:00:00 2031 GMT
        Subject: C = NL, O = Prodrive Technologies B.V., CN = Prodrive Technologies Atlas R46 OV TLS CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                08:16:BF:FD:B4:6F:4B:37:D4:9A:8C:1C:FB:EA:CE:2A:EB:C0:94:B5
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 79DE64F790E6DFC7A65B0B5BB0DC4EF0AC835F9914C7A25E4455670282C1E73A
    SPKI SHA256: 103237EEB0A6460BA55E406AC5423DBF7D7B84D5D837965CAF98EDECF92BEA6D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Prodrive Technologies B.V. Client Issuing CA

- Subject: countryName=NL, stateOrProvinceName=Noord-Brabant, localityName=Son, organizationalUnitName=IT Services, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. Client Issuing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E366785F285690E9FF818FBC
- SHA-256: 764B3C5FDF585C52A49FB331C2C18F7A02411674129EFDFCA850F9F643DF52D4
- SPKI SHA-256: EB8F81122442377034D0DBC6F010748A2CFB05798B22347991FB31CD1E65B394
- Validity: 2017-06-21 to 2022-06-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:66:78:5f:28:56:90:e9:ff:81:8f:bc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Jun 21 00:00:00 2017 GMT
            Not After : Jun 21 00:00:00 2022 GMT
        Subject: C = NL, ST = Noord-Brabant, L = Son, OU = IT Services, O = Prodrive Technologies B.V., CN = Prodrive Technologies B.V. Client Issuing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:75:F5:69:F1:E2:7A:CC:5F:27:13:7B:0B:0D:00:74:00:0A:3C:85
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 764B3C5FDF585C52A49FB331C2C18F7A02411674129EFDFCA850F9F643DF52D4
    SPKI SHA256: EB8F81122442377034D0DBC6F010748A2CFB05798B22347991FB31CD1E65B394
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Prodrive Technologies B.V. OV SSL Issuing CA

- Subject: countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. OV SSL Issuing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D7FE5653559939840B63FF5E1E5
- SHA-256: 580BB3AB127F5E13E940AE7365E3C69A62AD204D7FDFA451592FE7C47DC02A95
- SPKI SHA-256: FB0778BA13C86E8F321F0090B8A48F8ABEAD36B87D0B8C4EFB2229DA65C5BD6C
- Validity: 2020-07-05 to 2022-06-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/prodrivetechnologiesovssl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:7f:e5:65:35:59:93:98:40:b6:3f:f5:e1:e5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Jun 21 00:00:00 2022 GMT
        Subject: C = NL, O = Prodrive Technologies B.V., CN = Prodrive Technologies B.V. OV SSL Issuing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                75:96:B6:84:C9:B7:0B:91:E7:8E:E0:C6:EF:DF:EA:A3:C2:FF:E0:B8
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 580BB3AB127F5E13E940AE7365E3C69A62AD204D7FDFA451592FE7C47DC02A95
    SPKI SHA256: FB0778BA13C86E8F321F0090B8A48F8ABEAD36B87D0B8C4EFB2229DA65C5BD6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Prodrive Technologies B.V. OV SSL Issuing CA

- Subject: countryName=NL, stateOrProvinceName=Noord-Brabant, localityName=Son, organizationalUnitName=IT Services, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies B.V. OV SSL Issuing CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E272B85D7C23EBF594001C0F
- SHA-256: 398B1499CE00A25F61CAC3D8BEE571601880823EF288BE9772A4D13398422595
- SPKI SHA-256: FB0778BA13C86E8F321F0090B8A48F8ABEAD36B87D0B8C4EFB2229DA65C5BD6C
- Validity: 2017-06-21 to 2022-06-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e2:72:b8:5d:7c:23:eb:f5:94:00:1c:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Jun 21 00:00:00 2017 GMT
            Not After : Jun 21 00:00:00 2022 GMT
        Subject: C = NL, ST = Noord-Brabant, L = Son, OU = IT Services, O = Prodrive Technologies B.V., CN = Prodrive Technologies B.V. OV SSL Issuing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                75:96:B6:84:C9:B7:0B:91:E7:8E:E0:C6:EF:DF:EA:A3:C2:FF:E0:B8
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 398B1499CE00A25F61CAC3D8BEE571601880823EF288BE9772A4D13398422595
    SPKI SHA256: FB0778BA13C86E8F321F0090B8A48F8ABEAD36B87D0B8C4EFB2229DA65C5BD6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Prodrive Technologies GCC R3 OV TLS CA 2022

- Subject: countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies GCC R3 OV TLS CA 2022
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C7F7F0820F839C7454ED2978475
- SHA-256: 1005370ED276B0CEF39244E9E699CE4807BF9ADE05BFA59F263809FB4606B72C
- SPKI SHA-256: B5A8478174BD26D5B8503727BCD7BC9F989689C16912408AA1C69B22FEC21CC0
- Validity: 2022-04-20 to 2025-04-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/prodrivetechnologiesgccr3ovtlsca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:7f:7f:08:20:f8:39:c7:45:4e:d2:97:84:75
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Apr 20 00:00:00 2025 GMT
        Subject: C = NL, O = Prodrive Technologies B.V., CN = Prodrive Technologies GCC R3 OV TLS CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6F:C7:82:91:B7:30:34:7E:58:B7:27:ED:E5:83:F7:6E:FA:6A:D7:E6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1005370ED276B0CEF39244E9E699CE4807BF9ADE05BFA59F263809FB4606B72C
    SPKI SHA256: B5A8478174BD26D5B8503727BCD7BC9F989689C16912408AA1C69B22FEC21CC0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Prodrive Technologies GCC R6 OV TLS CA 2024

- Subject: countryName=NL, organizationName=Prodrive Technologies B.V., commonName=Prodrive Technologies GCC R6 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB3002861FBD96085ED8D669B793
- SHA-256: D978D8503D1F267CB0271DF91422CCEF20F17F4B6E84625763156D52D07484A8
- SPKI SHA-256: D2F2489A4C6907B82E30ADF4EC857C135AB3D0E952C5516A5FB2E0D78B1C6874
- Validity: 2024-09-18 to 2029-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/prodrivetechnologiesgccr6ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:30:02:86:1f:bd:96:08:5e:d8:d6:69:b7:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:13:15 2024 GMT
            Not After : Sep 18 00:00:00 2029 GMT
        Subject: C = NL, O = Prodrive Technologies B.V., CN = Prodrive Technologies GCC R6 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:B4:A0:94:D1:FD:54:C3:23:44:73:86:DA:16:2B:29:18:17:9B:27
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D978D8503D1F267CB0271DF91422CCEF20F17F4B6E84625763156D52D07484A8
    SPKI SHA256: D2F2489A4C6907B82E30ADF4EC857C135AB3D0E952C5516A5FB2E0D78B1C6874
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Quálitas Compañía de Seguros S.A. de C.V.

- Subject: countryName=MX, organizationName=QUALITAS COMPAÑIA DE SEGUROS S.A. DE C.V., localityName=CUAJIMALPA, stateOrProvinceName=CIUDAD DE MEXICO, streetAddress=JOSE MARIA CASTORENA No. 426, SAN JOSE DE LOS CEDROS, postalCode=05200, commonName=Quálitas Compañía de Seguros S.A. de C.V.
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 75A8B9BAD7EEEAB0CDA30518F716D66E
- SHA-256: B716B089FE4E53D1A2EF7BA57AC85E68EC722CF61052C25A59626AD3B15C5F40
- SPKI SHA-256: 97141A9E4A20E937FF92ECB9D6FD321CFA7B540942987D2B034440BEE9D44765
- Validity: 2019-08-21 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:b9:ba:d7:ee:ea:b0:cd:a3:05:18:f7:16:d6:6e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Aug 21 00:00:00 2019 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = MX, O = QUALITAS COMPA\C3\91IA DE SEGUROS S.A. DE C.V., L = CUAJIMALPA, ST = CIUDAD DE MEXICO, street = "JOSE MARIA CASTORENA No. 426, SAN JOSE DE LOS CEDROS", postalCode = 05200, CN = Qu\C3\A1litas Compa\C3\B1\C3\ADa de Seguros S.A. de C.V.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                96:7E:1B:5A:D2:EA:0C:20:2F:64:B9:9B:15:39:9E:44:04:D7:0D:D3
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B716B089FE4E53D1A2EF7BA57AC85E68EC722CF61052C25A59626AD3B15C5F40
    SPKI SHA256: 97141A9E4A20E937FF92ECB9D6FD321CFA7B540942987D2B034440BEE9D44765
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Quálitas Compañía de Seguros S.A. de C.V. GCC R3 CA 2020

- Subject: countryName=MX, organizationName=Quálitas Compañía de Seguros S.A. de C.V., commonName=Quálitas Compañía de Seguros S.A. de C.V. GCC R3 CA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 78031A9B4655902C3C4CC1EE32712910
- SHA-256: 795A8468D098E3729E6A17920AA6D8F27E84DC180F85C9B28A77FB368DCC7895
- SPKI SHA-256: 7D0877B18A8E58555D99D834603949EE497357DD614C30DF042E4DC02846BC96
- Validity: 2020-08-19 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/qcssagccr3ca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:1a:9b:46:55:90:2c:3c:4c:c1:ee:32:71:29:10
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 19 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = MX, O = Qu\C3\A1litas Compa\C3\B1\C3\ADa de Seguros S.A. de C.V., CN = Qu\C3\A1litas Compa\C3\B1\C3\ADa de Seguros S.A. de C.V. GCC R3 CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B5:E6:13:03:B7:E9:E9:BA:4F:26:FA:1F:09:BC:C5:9C:8F:B4:B1:F6
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 795A8468D098E3729E6A17920AA6D8F27E84DC180F85C9B28A77FB368DCC7895
    SPKI SHA256: 7D0877B18A8E58555D99D834603949EE497357DD614C30DF042E4DC02846BC96
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Riksgälden Insättningsgarantin GCC R45 SMIME CA 2025

- Subject: countryName=SE, organizationName=Riksgälden, commonName=Riksgälden Insättningsgarantin GCC R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 84CF275495B656FD3279D657970C6401
- SHA-256: 94B0EAD1EFCF285669284DB0434D3BB7581DC89D2BD4A0305E5F07A461045E41
- SPKI SHA-256: 822A07105F3A3760104895C53180A46D19562C395018FF1560D3A6AECBDDA1C4
- Validity: 2025-12-10 to 2035-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/riksgaldengccr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:27:54:95:b6:56:fd:32:79:d6:57:97:0c:64:01
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Dec 10 03:23:06 2025 GMT
            Not After : Dec 10 00:00:00 2035 GMT
        Subject: C = SE, O = Riksg\C3\A4lden, CN = Riksg\C3\A4lden Ins\C3\A4ttningsgarantin GCC R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:0E:25:7F:10:E7:85:8C:73:52:FF:B0:B9:EB:A3:ED:A6:68:04:C3
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 94B0EAD1EFCF285669284DB0434D3BB7581DC89D2BD4A0305E5F07A461045E41
    SPKI SHA256: 822A07105F3A3760104895C53180A46D19562C395018FF1560D3A6AECBDDA1C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Riksgälden Insättningsgarantin GCC R6 SMIME CA 2023

- Subject: countryName=SE, organizationName=Riksgälden, commonName=Riksgälden Insättningsgarantin GCC R6 SMIME CA 2023
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F4DBCA0694C83C43373FE2E4132BBBB
- SHA-256: B0959E4BF3FEF426496F44615FA955359DEB6C30D0A67866FCE40FF3122F7F4F
- SPKI SHA-256: 5DC44EAB13C1868D16480DB2D26F0B706912A42B967CA470CCAE7B79FB02EE71
- Validity: 2023-08-16 to 2033-08-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/riksgaldengccr6smimeca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 1.3.6.1.4.1.4146.10.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:4d:bc:a0:69:4c:83:c4:33:73:fe:2e:41:32:bb:bb
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 16 03:18:01 2023 GMT
            Not After : Aug 16 00:00:00 2033 GMT
        Subject: C = SE, O = Riksg\C3\A4lden, CN = Riksg\C3\A4lden Ins\C3\A4ttningsgarantin GCC R6 SMIME CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                62:72:AB:BB:99:4F:1B:F3:AC:A8:50:D7:2A:DE:AA:BB:AA:A1:DF:9E
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 1.3.6.1.4.1.4146.10.3.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B0959E4BF3FEF426496F44615FA955359DEB6C30D0A67866FCE40FF3122F7F4F
    SPKI SHA256: 5DC44EAB13C1868D16480DB2D26F0B706912A42B967CA470CCAE7B79FB02EE71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 1.3.6.1.4.1.4146.10.3.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RISE Signing CA

- Subject: countryName=SE, stateOrProvinceName=Vastra Gotalands Lan, localityName=Goteborg, organizationalUnitName=IT, organizationName=RISE Research Institutes of Sweden AB, commonName=RISE Signing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 751E3F58A13A8BF6D89FA7E28459192C
- SHA-256: DCEB06E046A76706BD1D928FA2DB893DB550D2973914843C5CC5DBE2D9D9B79D
- SPKI SHA-256: 0017AB7A84B8B4794FDB65764B0A97FBF8120F1639CEC707A4C9C805D0E9A754
- Validity: 2019-06-19 to 2020-08-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.astazero.com","email:.processum.se","email:.ri.se","email:.rise-pfi.no","email:.risefr.no","email:astazero.com","email:processum.se","email:ri.se","email:rise-pfi.no","email:risefr.no"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:58:a1:3a:8b:f6:d8:9f:a7:e2:84:59:19:2c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jun 19 00:00:00 2019 GMT
            Not After : Aug  1 00:00:00 2020 GMT
        Subject: C = SE, ST = Vastra Gotalands Lan, L = Goteborg, OU = IT, O = RISE Research Institutes of Sweden AB, CN = RISE Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:5B:E5:94:58:FD:F9:F8:85:0C:0B:09:3E:A1:6C:E5:1C:09:8A:8C
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.astazero.com
                  email:.processum.se
                  email:.ri.se
                  email:.rise-pfi.no
                  email:.risefr.no
                  email:astazero.com
                  email:processum.se
                  email:ri.se
                  email:rise-pfi.no
                  email:risefr.no
                  DNS:astazero.com
                  DNS:processum.se
                  DNS:ri.se
                  DNS:rise-pfi.no
                  DNS:risefr.no
                  DirName:C = SE, O = RISE Research Institutes of Sweden AB
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DCEB06E046A76706BD1D928FA2DB893DB550D2973914843C5CC5DBE2D9D9B79D
    SPKI SHA256: 0017AB7A84B8B4794FDB65764B0A97FBF8120F1639CEC707A4C9C805D0E9A754
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.astazero.com","email:.processum.se","email:.ri.se","email:.rise-pfi.no","email:.risefr.no","email:astazero.com","email:processum.se","email:ri.se","email:rise-pfi.no","email:risefr.no"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RISE Signing CA

- Subject: countryName=SE, stateOrProvinceName=Vastra Gotalands Lan, localityName=Goteborg, organizationalUnitName=IT, organizationName=RISE Research Institutes of Sweden AB, commonName=RISE Signing CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E707D21E2A4C057DF531D3B6
- SHA-256: 29164F9C83B480C76921388D2D7A35D48C4965F148C2303A77DE553304531431
- SPKI SHA-256: 0017AB7A84B8B4794FDB65764B0A97FBF8120F1639CEC707A4C9C805D0E9A754
- Validity: 2018-01-17 to 2019-07-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.astazero.com","email:.processum.se","email:.ri.se","email:.rise-pfi.no","email:.risefr.no","email:astazero.com","email:processum.se","email:ri.se","email:rise-pfi.no","email:risefr.no"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:d2:1e:2a:4c:05:7d:f5:31:d3:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jan 17 00:00:00 2018 GMT
            Not After : Jul 17 00:00:00 2019 GMT
        Subject: C = SE, ST = Vastra Gotalands Lan, L = Goteborg, OU = IT, O = RISE Research Institutes of Sweden AB, CN = RISE Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5E:5B:E5:94:58:FD:F9:F8:85:0C:0B:09:3E:A1:6C:E5:1C:09:8A:8C
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.astazero.com
                  email:.processum.se
                  email:.ri.se
                  email:.rise-pfi.no
                  email:.risefr.no
                  email:astazero.com
                  email:processum.se
                  email:ri.se
                  email:rise-pfi.no
                  email:risefr.no
                  DNS:astazero.com
                  DNS:processum.se
                  DNS:ri.se
                  DNS:rise-pfi.no
                  DNS:risefr.no
                  DirName:C = SE, O = RISE Research Institutes of Sweden AB
                  DirName:O = RISE Research Institutes of Sweden AB
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 29164F9C83B480C76921388D2D7A35D48C4965F148C2303A77DE553304531431
    SPKI SHA256: 0017AB7A84B8B4794FDB65764B0A97FBF8120F1639CEC707A4C9C805D0E9A754
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.astazero.com","email:.processum.se","email:.ri.se","email:.rise-pfi.no","email:.risefr.no","email:astazero.com","email:processum.se","email:ri.se","email:rise-pfi.no","email:risefr.no"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RNP ICPEdu AR46 OV TLS CA 2025

- Subject: countryName=BR, organizationName=REDE NACIONAL DE ENSINO E PESQUISA - RNP, commonName=RNP ICPEdu AR46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84CF27AC812D1C4A629C9BFDFB8944F0
- SHA-256: A292CDF59905FC30016C22131D6F2E497449F155A05A234CCEC0E042171BF70F
- SPKI SHA-256: 2AC3BFD9908F69EE6705B1E46EB6464899ECA4C2D50F61CEC0C392E9096B3788
- Validity: 2025-12-10 to 2030-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/rnpicpeduar46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:27:ac:81:2d:1c:4a:62:9c:9b:fd:fb:89:44:f0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Dec 10 03:24:15 2025 GMT
            Not After : Dec 10 00:00:00 2030 GMT
        Subject: C = BR, O = REDE NACIONAL DE ENSINO E PESQUISA - RNP, CN = RNP ICPEdu AR46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C6:7E:29:22:4D:18:41:DF:13:08:30:CE:D2:47:48:35:C3:A3:5F:9E
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A292CDF59905FC30016C22131D6F2E497449F155A05A234CCEC0E042171BF70F
    SPKI SHA256: 2AC3BFD9908F69EE6705B1E46EB6464899ECA4C2D50F61CEC0C392E9096B3788
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RNP ICPEdu GR46 OV TLS CA 2025

- Subject: countryName=BR, organizationName=REDE NACIONAL DE ENSINO E PESQUISA - RNP, commonName=RNP ICPEdu GR46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84AC371369F2B3896C10759C657E0FD1
- SHA-256: E10747D4DA7BAB09CBA9952F019D3534CB9FBA070BF13D8791B1699CD2FF59DD
- SPKI SHA-256: 5724824D9D814613DE66B83386587EAEFC0CE79980452C09280715044B5A963F
- Validity: 2025-11-19 to 2030-11-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rnpicpedugr46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:ac:37:13:69:f2:b3:89:6c:10:75:9c:65:7e:0f:d1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Nov 19 03:27:55 2025 GMT
            Not After : Nov 19 00:00:00 2030 GMT
        Subject: C = BR, O = REDE NACIONAL DE ENSINO E PESQUISA - RNP, CN = RNP ICPEdu GR46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                94:B0:C9:4F:C1:E0:6C:EF:CE:C6:2B:6C:B3:B4:CB:22:8A:76:49:B7
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                Policy: 1.3.6.1.4.1.4146.1.20
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E10747D4DA7BAB09CBA9952F019D3534CB9FBA070BF13D8791B1699CD2FF59DD
    SPKI SHA256: 5724824D9D814613DE66B83386587EAEFC0CE79980452C09280715044B5A963F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2, 1.3.6.1.4.1.4146.1.20
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RNP ICPEdu OV SSL CA 2019

- Subject: countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, commonName=RNP ICPEdu OV SSL CA 2019
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0DADB3E2C08DAF4B08631AE89CE0
- SHA-256: 88FC18BD071BE1FBC53FFBC801F03F5B2C4DA87BBA0C098E2B4808F19EAB05FE
- SPKI SHA-256: DF8ACB0E6C79378B4596EFC54F2B998DECD7C614789613A6C66499F4F8F2A6BA
- Validity: 2020-07-05 to 2026-05-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/rnpicpeduovsslca2019.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:ad:b3:e2:c0:8d:af:4b:08:63:1a:e8:9c:e0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : May 15 00:00:00 2026 GMT
        Subject: C = BR, O = Rede Nacional de Ensino e Pesquisa - RNP, CN = RNP ICPEdu OV SSL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:30:C7:07:28:4B:CB:7A:8E:5B:FE:61:69:F7:D4:7A:B2:85:9B:48
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 88FC18BD071BE1FBC53FFBC801F03F5B2C4DA87BBA0C098E2B4808F19EAB05FE
    SPKI SHA256: DF8ACB0E6C79378B4596EFC54F2B998DECD7C614789613A6C66499F4F8F2A6BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RNP ICPEdu OV SSL CA 2019

- Subject: countryName=BR, organizationName=Rede Nacional de Ensino e Pesquisa - RNP, organizationalUnitName=Gerencia de Servicos (GSer), localityName=Rio de Janeiro, stateOrProvinceName=Rio de Janeiro, commonName=RNP ICPEdu OV SSL CA 2019
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 751E3EE78541E2D7EAECE3716C60E39E
- SHA-256: 42CFDDA6F660B8E5B4C1C411965A4519312559E3262F8DB69D2DAE17B26B3BA3
- SPKI SHA-256: DF8ACB0E6C79378B4596EFC54F2B998DECD7C614789613A6C66499F4F8F2A6BA
- Validity: 2019-05-15 to 2026-05-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3e:e7:85:41:e2:d7:ea:ec:e3:71:6c:60:e3:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: May 15 00:00:00 2019 GMT
            Not After : May 15 00:00:00 2026 GMT
        Subject: C = BR, O = Rede Nacional de Ensino e Pesquisa - RNP, OU = Gerencia de Servicos (GSer), L = Rio de Janeiro, ST = Rio de Janeiro, CN = RNP ICPEdu OV SSL CA 2019
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:30:C7:07:28:4B:CB:7A:8E:5B:FE:61:69:F7:D4:7A:B2:85:9B:48
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 42CFDDA6F660B8E5B4C1C411965A4519312559E3262F8DB69D2DAE17B26B3BA3
    SPKI SHA256: DF8ACB0E6C79378B4596EFC54F2B998DECD7C614789613A6C66499F4F8F2A6BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RT2 Atlas Client Authentication ICA 2022

- Subject: countryName=US, organizationName=Real Time Technologies, Inc., commonName=RT2 Atlas Client Authentication ICA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Client Authentication Root R45
- Serial: 7D877C04EE6DAFD27D88B347E04C5F62
- SHA-256: 086E13C1B237ABB0B2FD6A3424419E6F241BBB849CB60054F2309F1480592B5F
- SPKI SHA-256: 12AB59FC16C9BAACC6D614529B71DFAA64DDB31C44A399B812AF83A07ADAA31D
- Validity: 2022-11-16 to 2032-11-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/rt2atlasclientauthica2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- CRL DP: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:87:7c:04:ee:6d:af:d2:7d:88:b3:47:e0:4c:5f:62
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Client Authentication Root R45
        Validity
            Not Before: Nov 16 03:35:49 2022 GMT
            Not After : Nov 16 00:00:00 2032 GMT
        Subject: C = US, O = "Real Time Technologies, Inc.", CN = RT2 Atlas Client Authentication ICA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                31:0C:CF:4A:0C:B0:12:CA:E8:06:63:54:3C:64:CF:37:D0:FA:90:56
            X509v3 Authority Key Identifier:
                75:82:AA:1B:B6:B3:8D:19:8F:FC:A9:79:CC:3F:02:9A:F4:4F:CB:D9
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/clientauthrootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/clientauthrootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/clientauthrootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.2.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 086E13C1B237ABB0B2FD6A3424419E6F241BBB849CB60054F2309F1480592B5F
    SPKI SHA256: 12AB59FC16C9BAACC6D614529B71DFAA64DDB31C44A399B812AF83A07ADAA31D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.10.2.2
- AIA OCSP: http://ocsp.globalsign.com/clientauthrootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/clientauthrootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/clientauthrootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RTI SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=NC, organizationName=RTI International, commonName=RTI SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E123515566D28348B83A7CB9
- SHA-256: 5F7C6E6041DAA513CBFE3D4E07FDC84E230DA21AF2DE186460C9EC0481516DAB
- SPKI SHA-256: C4514A671D8DAEE8B70DFC76582CAA99231FFDF29AA66FE2486A83F47791799E
- Validity: 2017-03-15 to 2020-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e1:23:51:55:66:d2:83:48:b8:3a:7c:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Mar 15 00:00:00 2017 GMT
            Not After : Jun 27 00:00:00 2020 GMT
        Subject: C = US, ST = NC, O = RTI International, CN = RTI SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:18:89:71:4D:02:07:25:CC:71:86:40:23:26:AC:28:04:68:CA:21
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F7C6E6041DAA513CBFE3D4E07FDC84E230DA21AF2DE186460C9EC0481516DAB
    SPKI SHA256: C4514A671D8DAEE8B70DFC76582CAA99231FFDF29AA66FE2486A83F47791799E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### RWE Atlas R45 SMIME CA 2020

- Subject: countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC37517BAEC95A8A643F0CDE32D692
- SHA-256: 3EFEC6B78BC4864625AB1A3D286AB0A4440D86DB98E07891859CCE3CE7BCA3CA
- SPKI SHA-256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
- Validity: 2023-06-28 to 2030-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/rweatlasr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:51:7b:ae:c9:5a:8a:64:3f:0c:de:32:d6:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:22 2023 GMT
            Not After : Dec 17 00:00:00 2030 GMT
        Subject: C = DE, O = RWE AG, CN = RWE Atlas R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:FD:5E:FB:D0:A1:25:6A:FD:34:23:11:4A:D2:9B:56:EF:6D:3C:A7
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3EFEC6B78BC4864625AB1A3D286AB0A4440D86DB98E07891859CCE3CE7BCA3CA
    SPKI SHA256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RWE Atlas R45 SMIME CA 2020

- Subject: countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8114043747BEBFCDD94B55573FBA10B2
- SHA-256: 1DB4AFAC4E87938FE804ADA649D364DADD817878E0FD08A593C036716C19BC5B
- SPKI SHA-256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
- Validity: 2024-05-15 to 2030-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/rweatlasr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:37:47:be:bf:cd:d9:4b:55:57:3f:ba:10:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: May 15 03:23:49 2024 GMT
            Not After : Dec 17 00:00:00 2030 GMT
        Subject: C = DE, O = RWE AG, CN = RWE Atlas R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:FD:5E:FB:D0:A1:25:6A:FD:34:23:11:4A:D2:9B:56:EF:6D:3C:A7
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1DB4AFAC4E87938FE804ADA649D364DADD817878E0FD08A593C036716C19BC5B
    SPKI SHA256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### RWE Atlas R45 SMIME CA 2020

- Subject: countryName=DE, organizationName=RWE AG, commonName=RWE Atlas R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 784AAA90E0AC0C0A4B69389A1024D865
- SHA-256: BEE8FB99D7B9EC0CAEF1B1A6ACFFEABD777E31CBAC2D0E1846BDAEC4D5B18BE8
- SPKI SHA-256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
- Validity: 2020-12-17 to 2030-12-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/rweatlasr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:4a:aa:90:e0:ac:0c:0a:4b:69:38:9a:10:24:d8:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Dec 17 00:00:00 2020 GMT
            Not After : Dec 17 00:00:00 2030 GMT
        Subject: C = DE, O = RWE AG, CN = RWE Atlas R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:FD:5E:FB:D0:A1:25:6A:FD:34:23:11:4A:D2:9B:56:EF:6D:3C:A7
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/r3smr45cross2020.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BEE8FB99D7B9EC0CAEF1B1A6ACFFEABD777E31CBAC2D0E1846BDAEC4D5B18BE8
    SPKI SHA256: 7BAA3BE0828AC456D792AA84B6134A6CA3EA0406FDE5884484BCEFFA34F8D372
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/r3smr45cross2020.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SerasaACGlobal

- Subject: countryName=BR, organizationName=Serasa, organizationalUnitName=Serasa Autoridade Certificadora Global, commonName=SerasaACGlobal
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000118C1B41A6C
- SHA-256: F4F733B9CABC030167ED0C500A8C4405F8FB54729DD2C90A9AAD00C94DB45C49
- SPKI SHA-256: C0266B75F5104E2F3C83517708747FF198F5C148576E81B38CC7725DECCA6EC3
- Validity: 2008-03-18 to 2018-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:18:c1:b4:1a:6c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Mar 18 12:00:00 2008 GMT
            Not After : Mar 18 12:00:00 2018 GMT
        Subject: C = BR, O = Serasa, OU = Serasa Autoridade Certificadora Global, CN = SerasaACGlobal
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                22:29:F4:D5:E8:15:5B:B2:5E:67:EA:30:A7:F5:71:41:2D:8C:2F:69
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F4F733B9CABC030167ED0C500A8C4405F8FB54729DD2C90A9AAD00C94DB45C49
    SPKI SHA256: C0266B75F5104E2F3C83517708747FF198F5C148576E81B38CC7725DECCA6EC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SHECA DV Secure Server CA

- Subject: countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA DV Secure Server CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01F240425698C20E8FC13CF5F5
- SHA-256: 393B8B15CABC3886FB2E416495D63C8BADD8DCAF87552076C8A0A9637C24DE47
- SPKI SHA-256: BF1439AEB30FAE8262FFEF85BCA3A236D57413E4829A37FE8358C0D865E875E7
- Validity: 2019-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:42:56:98:c2:0e:8f:c1:3c:f5:f5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 20 00:00:00 2019 GMT
            Not After : Feb 20 00:00:00 2024 GMT
        Subject: C = CN, O = "Shanghai Electronic Certificate Authority Center Co., Ltd.", L = Shanghai, ST = Shanghai, CN = SHECA DV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                92:F5:48:E3:B8:6A:02:17:12:3A:71:47:C5:F8:15:4C:3C:F3:0B:41
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 393B8B15CABC3886FB2E416495D63C8BADD8DCAF87552076C8A0A9637C24DE47
    SPKI SHA256: BF1439AEB30FAE8262FFEF85BCA3A236D57413E4829A37FE8358C0D865E875E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SHECA EV Secure Server CA

- Subject: countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA EV Secure Server CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01F24042718236ECFC35115041
- SHA-256: 147C447FEEB86202B503314FCAF0036BEAAEF437C39B56B358EC446A9D20387F
- SPKI SHA-256: C62E08357D4534AC5B9D50197704EB30D0EBBA64F0C451C9F357E0F9EFDDDA57
- Validity: 2019-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:42:71:82:36:ec:fc:35:11:50:41
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 20 00:00:00 2019 GMT
            Not After : Feb 20 00:00:00 2024 GMT
        Subject: C = CN, O = "Shanghai Electronic Certificate Authority Center Co., Ltd.", L = Shanghai, ST = Shanghai, CN = SHECA EV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8C:F7:64:B9:BA:7F:94:C0:79:BF:2E:AD:75:85:C3:7E:2B:B2:41:2B
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 147C447FEEB86202B503314FCAF0036BEAAEF437C39B56B358EC446A9D20387F
    SPKI SHA256: C62E08357D4534AC5B9D50197704EB30D0EBBA64F0C451C9F357E0F9EFDDDA57
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SHECA OV Secure Server CA

- Subject: countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., localityName=Shanghai, stateOrProvinceName=Shanghai, commonName=SHECA OV Secure Server CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01F24042617238149BFAEB8D6C
- SHA-256: 77EAC476453CB732257FF166A5EBD1656CB1F673B68E28DF41774133979FA2A4
- SPKI SHA-256: 1AFC902B44C0D9087E075AEF38C236F173E6062243E7D950AF0CFF37E8903BF5
- Validity: 2019-02-20 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f2:40:42:61:72:38:14:9b:fa:eb:8d:6c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 20 00:00:00 2019 GMT
            Not After : Feb 20 00:00:00 2024 GMT
        Subject: C = CN, O = "Shanghai Electronic Certificate Authority Center Co., Ltd.", L = Shanghai, ST = Shanghai, CN = SHECA OV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9D:F7:60:A6:08:EC:60:C9:3E:7F:4D:39:F8:2D:FE:C5:DD:EB:4C:3A
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 77EAC476453CB732257FF166A5EBD1656CB1F673B68E28DF41774133979FA2A4
    SPKI SHA256: 1AFC902B44C0D9087E075AEF38C236F173E6062243E7D950AF0CFF37E8903BF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SHECA OV Secure Server CA

- Subject: countryName=CN, organizationName=Shanghai Electronic Certificate Authority Center Co., Ltd., commonName=SHECA OV Secure Server CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D844CCF1871BC8234A65E663D6D
- SHA-256: AD7B58C3C5D9586BE5B62799C2792C4111C9852A96F7B0607221265713957E1C
- SPKI SHA-256: 1AFC902B44C0D9087E075AEF38C236F173E6062243E7D950AF0CFF37E8903BF5
- Validity: 2020-07-05 to 2024-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/shecaovsecureserver.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:84:4c:cf:18:71:bc:82:34:a6:5e:66:3d:6d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Feb 20 00:00:00 2024 GMT
        Subject: C = CN, O = "Shanghai Electronic Certificate Authority Center Co., Ltd.", CN = SHECA OV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9D:F7:60:A6:08:EC:60:C9:3E:7F:4D:39:F8:2D:FE:C5:DD:EB:4C:3A
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD7B58C3C5D9586BE5B62799C2792C4111C9852A96F7B0607221265713957E1C
    SPKI SHA256: 1AFC902B44C0D9087E075AEF38C236F173E6062243E7D950AF0CFF37E8903BF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SignTrust Domain Verification CA

- Subject: organizationalUnitName=SignTrust Domain Verification CA, organizationName=SignTrust, commonName=SignTrust Domain Verification CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012945C3A80F
- SHA-256: C02BD342CD70128DA58E46E0F4C6464A045ABDA0285DDE52B13F09293FDA646F
- SPKI SHA-256: 631EA357DD64B079A88AF28C3FBA1160DA9156A39A78DAD041C653DC3376170A
- Validity: 2010-06-17 to 2020-06-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:29:45:c3:a8:0f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Jun 17 12:00:00 2010 GMT
            Not After : Jun 17 12:00:00 2020 GMT
        Subject: OU = SignTrust Domain Verification CA, O = SignTrust, CN = SignTrust Domain Verification CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8D:15:37:B8:8D:E0:0B:1F:46:F0:DD:4B:E5:F6:7C:8C:A2:93:E6:88
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10.20
                  CPS: http://www.signtrust.co.id/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Netscape Cert Type:
                SSL CA, S/MIME CA
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C02BD342CD70128DA58E46E0F4C6464A045ABDA0285DDE52B13F09293FDA646F
    SPKI SHA256: 631EA357DD64B079A88AF28C3FBA1160DA9156A39A78DAD041C653DC3376170A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.20
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SignTrust Domain Verification CA - G2

- Subject: organizationalUnitName=SignTrust Domain Verification CA - G2, organizationName=SignTrust, commonName=SignTrust Domain Verification CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 0400000000012F4EE13916
- SHA-256: DAC1A51E6A44088E77020CA9704C361241FE2DDC42F8132677BA5EBBBA4D0C2C
- SPKI SHA-256: 7EB987441CB821565FE7D80A796DAFAF48C9E5C4E2DF3F96B2000C051EB8AEA4
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:39:16
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: OU = SignTrust Domain Verification CA - G2, O = SignTrust, CN = SignTrust Domain Verification CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:2E:88:A5:57:32:40:AA:4E:4A:89:D9:AB:FB:D3:50:8B:52:23:14
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.signtrust.co.id/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DAC1A51E6A44088E77020CA9704C361241FE2DDC42F8132677BA5EBBBA4D0C2C
    SPKI SHA256: 7EB987441CB821565FE7D80A796DAFAF48C9E5C4E2DF3F96B2000C051EB8AEA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SignTrust Domain Verification CA - SHA256 - G2

- Subject: organizationalUnitName=SignTrust Domain Verification CA - SHA256 - G2, organizationName=SignTrust, commonName=SignTrust Domain Verification CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000013189C63C2E
- SHA-256: BECD7B1B8C6807A2963B3AEE9BE60A314EBEAF3EA4C30AF39B7AA6C082583CE0
- SPKI SHA-256: 078737F4B573EFC16D670E1B0AF91748EF08B9DE5ADEF6DC4679D0C34CD0AB33
- Validity: 2011-08-02 to 2022-08-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:31:89:c6:3c:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug  2 10:00:00 2011 GMT
            Not After : Aug  2 10:00:00 2022 GMT
        Subject: OU = SignTrust Domain Verification CA - SHA256 - G2, O = SignTrust, CN = SignTrust Domain Verification CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                35:02:8D:3A:8B:68:29:76:25:F9:75:4E:79:AD:D4:77:7C:58:EC:56
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.signtrust.co.id/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BECD7B1B8C6807A2963B3AEE9BE60A314EBEAF3EA4C30AF39B7AA6C082583CE0
    SPKI SHA256: 078737F4B573EFC16D670E1B0AF91748EF08B9DE5ADEF6DC4679D0C34CD0AB33
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Soluti CA - DV

- Subject: countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - DV
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 47C30FFCD402018125BA9FB6E8C9
- SHA-256: A74FFFF528471905385073ADF3997019B26F4FAF24BCE9102A272E7A4484E4BC
- SPKI SHA-256: 900CCC7AEC2350159F3CBE581187D01BDA8AFC0043C65D0132F3EDCF010F37B1
- Validity: 2016-02-24 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:0f:fc:d4:02:01:81:25:ba:9f:b6:e8:c9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 24 00:00:00 2016 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, ST = Goi\C3\A1s, L = Goi\C3\A2nia, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - DV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:E1:03:20:65:0B:FA:03:49:A4:F6:73:33:C9:A0:66:BF:D7:87:52
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A74FFFF528471905385073ADF3997019B26F4FAF24BCE9102A272E7A4484E4BC
    SPKI SHA256: 900CCC7AEC2350159F3CBE581187D01BDA8AFC0043C65D0132F3EDCF010F37B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti CA - DV

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - DV
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D87E831151ABFFFF6A053329CA3
- SHA-256: 5C452334D9C9C9A2EA42CC77A7165E1795EE9D84EB70CB784B47EA9D92A582D9
- SPKI SHA-256: 900CCC7AEC2350159F3CBE581187D01BDA8AFC0043C65D0132F3EDCF010F37B1
- Validity: 2020-07-05 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutidvsha256g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:87:e8:31:15:1a:bf:ff:f6:a0:53:32:9c:a3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - DV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:E1:03:20:65:0B:FA:03:49:A4:F6:73:33:C9:A0:66:BF:D7:87:52
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5C452334D9C9C9A2EA42CC77A7165E1795EE9D84EB70CB784B47EA9D92A582D9
    SPKI SHA256: 900CCC7AEC2350159F3CBE581187D01BDA8AFC0043C65D0132F3EDCF010F37B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti CA - EV

- Subject: countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - EV
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 47C30FFDE9CA70684B887A570DDF
- SHA-256: BB170B39784D02784325CEA938D92314C617DDE808C867E33E2AD161D54B3E8A
- SPKI SHA-256: 67A680A4819695C31664716D0663F5160661C8B29AAD36A54A8D20E7E11E1B45
- Validity: 2016-02-24 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:0f:fd:e9:ca:70:68:4b:88:7a:57:0d:df
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 24 00:00:00 2016 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, ST = Goi\C3\A1s, L = Goi\C3\A2nia, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - EV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                24:08:BC:0A:80:5C:39:BA:B8:16:77:7E:92:91:4A:32:F2:BA:C9:2A
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB170B39784D02784325CEA938D92314C617DDE808C867E33E2AD161D54B3E8A
    SPKI SHA256: 67A680A4819695C31664716D0663F5160661C8B29AAD36A54A8D20E7E11E1B45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti CA - EV

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - EV
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D90DE4395999A06154B4A121A9A
- SHA-256: 11FBA4A7EE579C70E1D57F9F9B6A8C209E1219C4F1D3846F83FFCE74E9E5E2CE
- SPKI SHA-256: 67A680A4819695C31664716D0663F5160661C8B29AAD36A54A8D20E7E11E1B45
- Validity: 2020-07-05 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutievsha256g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:90:de:43:95:99:9a:06:15:4b:4a:12:1a:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - EV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                24:08:BC:0A:80:5C:39:BA:B8:16:77:7E:92:91:4A:32:F2:BA:C9:2A
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11FBA4A7EE579C70E1D57F9F9B6A8C209E1219C4F1D3846F83FFCE74E9E5E2CE
    SPKI SHA256: 67A680A4819695C31664716D0663F5160661C8B29AAD36A54A8D20E7E11E1B45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti CA - OV

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - OV
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D8BD8393E66D492F8A39DDFF004
- SHA-256: AB74B1411AD23E2227FB88A2A9304A1A45A5C4840B3635F1036A46E8374279AC
- SPKI SHA-256: AC26E9CF624F6E720266D33AF4BB7679C96A753B2CD0C8F46787A35CC1759C3E
- Validity: 2020-07-05 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiovsha256g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:8b:d8:39:3e:66:d4:92:f8:a3:9d:df:f0:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - OV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                89:74:0B:BB:B1:51:75:11:93:EE:4B:4B:20:EF:61:6E:B8:A1:07:E6
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB74B1411AD23E2227FB88A2A9304A1A45A5C4840B3635F1036A46E8374279AC
    SPKI SHA256: AC26E9CF624F6E720266D33AF4BB7679C96A753B2CD0C8F46787A35CC1759C3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti CA - OV

- Subject: countryName=BR, stateOrProvinceName=Goiás, localityName=Goiânia, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti CA - OV
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 47C30FFD59D27681F66EF9C5A075
- SHA-256: E6E929C8456C014E8DA733ACE4E9814552272B81176050A13EA45A823200B14B
- SPKI SHA-256: AC26E9CF624F6E720266D33AF4BB7679C96A753B2CD0C8F46787A35CC1759C3E
- Validity: 2016-02-24 to 2026-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:c3:0f:fd:59:d2:76:81:f6:6e:f9:c5:a0:75
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Feb 24 00:00:00 2016 GMT
            Not After : Feb 24 00:00:00 2026 GMT
        Subject: C = BR, ST = Goi\C3\A1s, L = Goi\C3\A2nia, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti CA - OV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                89:74:0B:BB:B1:51:75:11:93:EE:4B:4B:20:EF:61:6E:B8:A1:07:E6
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E6E929C8456C014E8DA733ACE4E9814552272B81176050A13EA45A823200B14B
    SPKI SHA256: AC26E9CF624F6E720266D33AF4BB7679C96A753B2CD0C8F46787A35CC1759C3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Soluti V2 GR46 DV TLS CA 2025

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 DV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84CF277463D1D43DA6C1FB6D41DCD812
- SHA-256: 7757FE3298F39B0BAC4E830D6F98C828E7A77780E485C01958864E7D24B3DBD1
- SPKI SHA-256: 135F8771FF67EF7C6631AD9C733B7EBF8FE9FFA3ABACDDFB96BB8B84258A3FF3
- Validity: 2025-12-10 to 2030-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr46dvtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:27:74:63:d1:d4:3d:a6:c1:fb:6d:41:dc:d8:12
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Dec 10 03:23:31 2025 GMT
            Not After : Dec 10 00:00:00 2030 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR46 DV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EA:86:65:20:DE:6D:5F:24:40:00:D2:25:C4:73:58:54:BF:43:13:12
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7757FE3298F39B0BAC4E830D6F98C828E7A77780E485C01958864E7D24B3DBD1
    SPKI SHA256: 135F8771FF67EF7C6631AD9C733B7EBF8FE9FFA3ABACDDFB96BB8B84258A3FF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soluti V2 GR46 EV TLS CA 2025

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 EV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84CF279FAB0FDECDDEECFE5091DF5215
- SHA-256: 45BC6AE95E407AB5E56AFDFEEE38CED8E96A6AC9032AD4D122C5ACB46BDC3312
- SPKI SHA-256: 43E2B66474CE2432BF64BF26B5720B67AC9F2FEFEDC696226DC9A6AF83560B1B
- Validity: 2025-12-10 to 2030-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr46evtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:27:9f:ab:0f:de:cd:de:ec:fe:50:91:df:52:15
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Dec 10 03:24:05 2025 GMT
            Not After : Dec 10 00:00:00 2030 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR46 EV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                07:DD:07:F1:F1:81:5E:08:CD:06:16:9D:14:10:68:B0:6A:15:36:A7
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 45BC6AE95E407AB5E56AFDFEEE38CED8E96A6AC9032AD4D122C5ACB46BDC3312
    SPKI SHA256: 43E2B66474CE2432BF64BF26B5720B67AC9F2FEFEDC696226DC9A6AF83560B1B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soluti V2 GR46 OV TLS CA 2025

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR46 OV TLS CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Root R46
- Serial: 84CF27914C91E583A585FE5CB62150D6
- SHA-256: 6B227EE8850FB113478A8B835A6E03A6EB3FB5191BFB9AB29D882EA69BA5094D
- SPKI SHA-256: C253476653D0DF9CD0ACABFE45BC67C2BA078FF664C5A638C19F0319082F4FE2
- Validity: 2025-12-10 to 2030-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr46ovtlsca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- CRL DP: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:27:91:4c:91:e5:83:a5:85:fe:5c:b6:21:50:d6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
        Validity
            Not Before: Dec 10 03:23:54 2025 GMT
            Not After : Dec 10 00:00:00 2030 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR46 OV TLS CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D4:80:BC:0C:E0:14:2A:B9:6C:CD:E0:09:0B:64:BD:D1:52:7C:27:4F
            X509v3 Authority Key Identifier:
                03:5C:AB:73:81:87:A8:CC:B0:A6:D5:94:E2:36:96:49:FF:05:99:2C
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr46
                CA Issuers - URI:http://secure.globalsign.com/cacert/rootr46.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/rootr46.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6B227EE8850FB113478A8B835A6E03A6EB3FB5191BFB9AB29D882EA69BA5094D
    SPKI SHA256: C253476653D0DF9CD0ACABFE45BC67C2BA078FF664C5A638C19F0319082F4FE2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp.globalsign.com/rootr46
- AIA CA Issuers: http://secure.globalsign.com/cacert/rootr46.crt
- CRL Distribution Points: http://crl.globalsign.com/rootr46.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soluti V2 GR6 DV TLS CA 2024

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 DV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 824E74FFC75BFE839C93236EE1C5D2E9
- SHA-256: BA7651165CE1B82DC477CBBC501BE1AF67CDE182F233262FEF5D205F197738C6
- SPKI SHA-256: E53AE84B3E34EA7EAAD0BE78AEC807C770B75466EDB6E7E91379BDC2CAEF2CD9
- Validity: 2024-11-20 to 2029-11-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr6dvtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:4e:74:ff:c7:5b:fe:83:9c:93:23:6e:e1:c5:d2:e9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 02:35:16 2024 GMT
            Not After : Nov 20 00:00:00 2029 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR6 DV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DE:B7:B0:56:0F:D8:6C:E4:A2:92:28:46:ED:A4:FC:9C:39:11:1E:90
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA7651165CE1B82DC477CBBC501BE1AF67CDE182F233262FEF5D205F197738C6
    SPKI SHA256: E53AE84B3E34EA7EAAD0BE78AEC807C770B75466EDB6E7E91379BDC2CAEF2CD9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soluti V2 GR6 EV TLS CA 2024

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 EV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 824E7529C8F15813BF01B73190E13545
- SHA-256: A9A4BEFCDB349939452D22F3DD8BFDE4C840542B57BAEED88B22A11C7BC7F98B
- SPKI SHA-256: D3E9943106C4497708BCDA810366A95218A7FAD26AD36DE8892266158116DAF1
- Validity: 2024-11-20 to 2029-11-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr6evtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:4e:75:29:c8:f1:58:13:bf:01:b7:31:90:e1:35:45
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 02:35:49 2024 GMT
            Not After : Nov 20 00:00:00 2029 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR6 EV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D5:F7:32:DA:58:E6:B6:F6:A0:B3:91:13:57:74:84:0A:BE:F5:65:9D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                Policy: 1.3.6.1.4.1.4146.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A9A4BEFCDB349939452D22F3DD8BFDE4C840542B57BAEED88B22A11C7BC7F98B
    SPKI SHA256: D3E9943106C4497708BCDA810366A95218A7FAD26AD36DE8892266158116DAF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1, 1.3.6.1.4.1.4146.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soluti V2 GR6 OV TLS CA 2024

- Subject: countryName=BR, organizationName=SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, commonName=Soluti V2 GR6 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 824E752044A1D9A39A77C06C4E9C5689
- SHA-256: 24952CB05B0D97A9F12B458C7EE6C3F3A140F51DF4462193D97528FD89C8B8CD
- SPKI SHA-256: A36FEC889BBFCD310D592B584E2CE5359B74A55A8C9B622FCB216B4CB09188F8
- Validity: 2024-11-20 to 2029-11-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/solutiv2gr6ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:4e:75:20:44:a1:d9:a3:9a:77:c0:6c:4e:9c:56:89
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 20 02:35:42 2024 GMT
            Not After : Nov 20 00:00:00 2029 GMT
        Subject: C = BR, O = SOLUTI - SOLUCOES EM NEGOCIOS INTELIGENTES S/A, CN = Soluti V2 GR6 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0D:20:B7:14:82:18:FB:BF:15:8A:A7:A8:1C:9D:46:8C:CB:17:CE:9E
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 24952CB05B0D97A9F12B458C7EE6C3F3A140F51DF4462193D97528FD89C8B8CD
    SPKI SHA256: A36FEC889BBFCD310D592B584E2CE5359B74A55A8C9B622FCB216B4CB09188F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Southern Company External Policy CA

- Subject: countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 040000000001325855D4A2
- SHA-256: C9599691E9CEDD562F697885F8D29437B151EC909300178762B338F2FC093935
- SPKI SHA-256: 242CC094634E828C8BE9ACC12ACD01623A26C9BAF6A841FF3DF9A907FD498555
- Validity: 2011-09-27 to 2021-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:32:58:55:d4:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Sep 27 12:00:00 2011 GMT
            Not After : Sep 27 12:00:00 2021 GMT
        Subject: C = US, ST = GA, L = Atlanta, OU = "Southern Company Services, Inc.", O = "Southern Company Services, Inc.", CN = Southern Company External Policy CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                01:72:0A:5B:80:55:4D:64:90:40:3E:DC:68:99:1A:59:64:38:4E:F6
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: http://www.southerncompany.com/legal/cps.aspx
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C9599691E9CEDD562F697885F8D29437B151EC909300178762B338F2FC093935
    SPKI SHA256: 242CC094634E828C8BE9ACC12ACD01623A26C9BAF6A841FF3DF9A907FD498555
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Southern Company External Policy CA

- Subject: countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000133A777674B
- SHA-256: 9097B1DC39F65AE39248A591A45A8CD4E9C736A7A635908A06E12235D89FFBE6
- SPKI SHA-256: 0D01055B43177B64900CD85641CCB217C78603413E728732F9952D18814EB4A2
- Validity: 2011-11-15 to 2016-11-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.1204.509.2.2, 1.3.6.1.4.1.1204.509.2.3, 1.3.6.1.4.1.1204.509.2.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:33:a7:77:67:4b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Nov 15 12:00:00 2011 GMT
            Not After : Nov 15 12:00:00 2016 GMT
        Subject: C = US, ST = GA, L = Atlanta, OU = "Southern Company Services, Inc.", O = "Southern Company Services, Inc.", CN = Southern Company External Policy CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                53:42:C2:80:1D:3A:4A:F6:63:BB:1A:E6:EE:7F:C2:E9:D5:70:E0:B0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: GlobalSign Trusted Root Program.
                Policy: 1.3.6.1.4.1.1204.509.2.2
                  CPS: http://www.southerncompany.com/legal/cps.aspx
                Policy: 1.3.6.1.4.1.1204.509.2.3
                Policy: 1.3.6.1.4.1.1204.509.2.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9097B1DC39F65AE39248A591A45A8CD4E9C736A7A635908A06E12235D89FFBE6
    SPKI SHA256: 0D01055B43177B64900CD85641CCB217C78603413E728732F9952D18814EB4A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.1204.509.2.2, 1.3.6.1.4.1.1204.509.2.3, 1.3.6.1.4.1.1204.509.2.4
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Southern Company External Policy CA

- Subject: countryName=US, stateOrProvinceName=GA, localityName=Atlanta, organizationalUnitName=Southern Company Services, Inc., organizationName=Southern Company Services, Inc., commonName=Southern Company External Policy CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 04000000000132B4BBB768
- SHA-256: 14509B29DD65A03E12581550166921B4D17DF84332D9A1A14AB172E562A8093C
- SPKI SHA-256: 242CC094634E828C8BE9ACC12ACD01623A26C9BAF6A841FF3DF9A907FD498555
- Validity: 2011-09-29 to 2021-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:32:b4:bb:b7:68
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Sep 29 12:00:00 2011 GMT
            Not After : Sep 29 12:00:00 2021 GMT
        Subject: C = US, ST = GA, L = Atlanta, OU = "Southern Company Services, Inc.", O = "Southern Company Services, Inc.", CN = Southern Company External Policy CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                01:72:0A:5B:80:55:4D:64:90:40:3E:DC:68:99:1A:59:64:38:4E:F6
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: http://www.southerncompany.com/legal/cps.aspx
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 14509B29DD65A03E12581550166921B4D17DF84332D9A1A14AB172E562A8093C
    SPKI SHA256: 242CC094634E828C8BE9ACC12ACD01623A26C9BAF6A841FF3DF9A907FD498555
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Spirit AeroSystems Atlas R45 SMIME CA 2025

- Subject: countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 83431BF9F7D0FDED2FAE6AFD24CD0E48
- SHA-256: 833D0A9A74CE20C031B04C6228BF1151232A335C1562DE93ED28E1CC85341724
- SPKI SHA-256: BB65029C20A72344121359B4E5B4AC6C1B288654A217EA6B9A39CED18EBCEA7A
- Validity: 2025-04-16 to 2035-04-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/spiritaeroatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:43:1b:f9:f7:d0:fd:ed:2f:ae:6a:fd:24:cd:0e:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Apr 16 03:13:07 2025 GMT
            Not After : Apr 16 00:00:00 2035 GMT
        Subject: C = US, O = "Spirit AeroSystems, Inc.", CN = Spirit AeroSystems Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                00:AB:69:03:E0:06:64:15:58:9D:DC:D6:A0:C0:09:5A:75:E0:13:39
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 833D0A9A74CE20C031B04C6228BF1151232A335C1562DE93ED28E1CC85341724
    SPKI SHA256: BB65029C20A72344121359B4E5B4AC6C1B288654A217EA6B9A39CED18EBCEA7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Spirit AeroSystems GCC R45 SMIME CA 2020

- Subject: countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems GCC R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 78031853F6E4699F9FCC8F3F7718CABD
- SHA-256: 90D87E23B012A357851472CE9F4E49201F67BA9EC1FB9CD236C0C5AAA15FFE9E
- SPKI SHA-256: D7C7EBB885E62CCD46730A3B8BDC4D6E5A80E4601EB21406A8EE481D1451A34E
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/spiritaerosysgccr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:53:f6:e4:69:9f:9f:cc:8f:3f:77:18:ca:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = US, O = "Spirit AeroSystems, Inc.", CN = Spirit AeroSystems GCC R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8B:08:5E:9C:88:F2:5B:07:30:0E:92:1F:26:87:B6:30:F9:0A:55:13
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 90D87E23B012A357851472CE9F4E49201F67BA9EC1FB9CD236C0C5AAA15FFE9E
    SPKI SHA256: D7C7EBB885E62CCD46730A3B8BDC4D6E5A80E4601EB21406A8EE481D1451A34E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Spirit AeroSystems GCC R45 SMIME CA 2020

- Subject: countryName=US, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems GCC R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC37058E4B808C0A7BF0451FB64167
- SHA-256: 31BBB081F0B0811DB4AE11A7D2B36168A98DE8230253423F13B5B241A0E8C707
- SPKI SHA-256: D7C7EBB885E62CCD46730A3B8BDC4D6E5A80E4601EB21406A8EE481D1451A34E
- Validity: 2023-06-28 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/spiritaerosysgccr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:05:8e:4b:80:8c:0a:7b:f0:45:1f:b6:41:67
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:30:22 2023 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = US, O = "Spirit AeroSystems, Inc.", CN = Spirit AeroSystems GCC R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8B:08:5E:9C:88:F2:5B:07:30:0E:92:1F:26:87:B6:30:F9:0A:55:13
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
                Policy: 1.3.6.1.4.1.4146.1.40
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 31BBB081F0B0811DB4AE11A7D2B36168A98DE8230253423F13B5B241A0E8C707
    SPKI SHA256: D7C7EBB885E62CCD46730A3B8BDC4D6E5A80E4601EB21406A8EE481D1451A34E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Spirit AeroSystems SHA256 CA - G2

- Subject: countryName=US, stateOrProvinceName=KS, organizationName=Spirit AeroSystems, Inc., commonName=Spirit AeroSystems SHA256 CA - G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign PersonalSign Partners CA - SHA256 - G2
- Serial: 01E528B4AD0C3AF0B13705DD54
- SHA-256: 8609BDCEF95E4A4D426497B5CD8ED4B001C953A5C14471CAAF58FB650DF8ABF0
- SPKI SHA-256: F9E666DFC80144D4880C162B80B0E3DD88D1B360015120F9FECB2A9C20E06253
- Validity: 2017-09-20 to 2022-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- CRL DP: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b4:ad:0c:3a:f0:b1:37:05:dd:54
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign PersonalSign Partners CA - SHA256 - G2
        Validity
            Not Before: Sep 20 00:00:00 2017 GMT
            Not After : Sep 20 00:00:00 2022 GMT
        Subject: C = US, ST = KS, O = "Spirit AeroSystems, Inc.", CN = Spirit AeroSystems SHA256 CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0C:22:5D:73:30:50:9E:9F:6E:75:04:50:FC:69:B0:9E:96:8B:29:63
            X509v3 Authority Key Identifier:
                26:24:92:8B:1F:D3:44:AF:B1:B0:1B:6D:AF:EE:74:D2:8C:78:00:03
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8609BDCEF95E4A4D426497B5CD8ED4B001C953A5C14471CAAF58FB650DF8ABF0
    SPKI SHA256: F9E666DFC80144D4880C162B80B0E3DD88D1B360015120F9FECB2A9C20E06253
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/gspersonalsignptnrssha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gspersonalsignptnrssha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gspersonalsignptnrssha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### sslTrus GCC E5 OV TLS CA 2024

- Subject: countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC E5 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R5, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB7B6054205CF408692D62144861
- SHA-256: 2872602B9C18774BF4794F6844DCE559C57019930CE72BCF23131DDEF2484DED
- SPKI SHA-256: B981E8DF028489D9441287365F87D7EDE6794C2C5D2FD1C923259CA2B4AC7AB1
- Validity: 2024-09-18 to 2027-09-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ssltrusgcce5ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- CRL DP: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:7b:60:54:20:5c:f4:08:69:2d:62:14:48:61
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: OU = GlobalSign ECC Root CA - R5, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:14:15 2024 GMT
            Not After : Sep 18 00:00:00 2027 GMT
        Subject: C = CN, O = sslTrus Inc., CN = sslTrus GCC E5 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F7:36:E5:A5:8C:D3:60:65:71:D5:21:E6:97:80:17:2E:5D:DB:E7:7C
            X509v3 Authority Key Identifier:
                3D:E6:29:48:9B:EA:07:CA:21:44:4A:26:DE:6E:DE:D2:83:D0:9F:59
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr5
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r5.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r5.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2872602B9C18774BF4794F6844DCE559C57019930CE72BCF23131DDEF2484DED
    SPKI SHA256: B981E8DF028489D9441287365F87D7EDE6794C2C5D2FD1C923259CA2B4AC7AB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr5
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r5.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r5.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus GCC R6 DV TLS CA 2024

- Subject: countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 DV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB57413633B1E44C3C06CEB69FEE
- SHA-256: 183801AE042D1C2E7CFF3EB21C277B0D0823DE52FE0DEABF316FBE17ECC03B9C
- SPKI SHA-256: 7779C4ACC277A7FBF8E51CD5108FDFCA8F0273A554A5AE4FE9C333DE7DB55172
- Validity: 2024-09-18 to 2027-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ssltrusgccr6dvtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:57:41:36:33:b1:e4:4c:3c:06:ce:b6:9f:ee
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:13:46 2024 GMT
            Not After : Sep 18 00:00:00 2027 GMT
        Subject: C = CN, O = sslTrus Inc., CN = sslTrus GCC R6 DV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                7F:94:61:A8:7B:6A:0C:1D:50:8C:1F:16:14:EC:E2:F9:75:F9:D0:A4
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 183801AE042D1C2E7CFF3EB21C277B0D0823DE52FE0DEABF316FBE17ECC03B9C
    SPKI SHA256: 7779C4ACC277A7FBF8E51CD5108FDFCA8F0273A554A5AE4FE9C333DE7DB55172
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus GCC R6 EV TLS CA 2024

- Subject: countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 EV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB8C118D0F1F7EA079D3F3A37E3E
- SHA-256: 47347DFE1F786EE18A67DC8FACAD1A058A951F369C0A2AF2B6A168158A42A4D4
- SPKI SHA-256: B43D87DBD343D32505D0A920EEC409EF1FCA22B5F2741E3A018888B18AA05C57
- Validity: 2024-09-18 to 2027-09-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ssltrusgccr6evtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:8c:11:8d:0f:1f:7e:a0:79:d3:f3:a3:7e:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:14:28 2024 GMT
            Not After : Sep 18 00:00:00 2027 GMT
        Subject: C = CN, O = sslTrus Inc., CN = sslTrus GCC R6 EV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B4:7C:75:13:4F:C0:11:76:B9:C7:9C:88:A3:65:87:B0:E0:82:83:80
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 47347DFE1F786EE18A67DC8FACAD1A058A951F369C0A2AF2B6A168158A42A4D4
    SPKI SHA256: B43D87DBD343D32505D0A920EEC409EF1FCA22B5F2741E3A018888B18AA05C57
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus GCC R6 OV TLS CA 2024

- Subject: countryName=CN, organizationName=sslTrus Inc., commonName=sslTrus GCC R6 OV TLS CA 2024
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81E5AB6CD28E4B7246CA0F9E09EA0112
- SHA-256: 57A9CFB8EBBB0F1583AB496623D04135B5A1F220D3F31E33007327D3AC3159BC
- SPKI SHA-256: 629A35EEFA18C5838C4F58628A33054405ECF0E9BFA014C34545599A19C7BC69
- Validity: 2024-09-18 to 2027-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ssltrusgccr6ovtlsca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:e5:ab:6c:d2:8e:4b:72:46:ca:0f:9e:09:ea:01:12
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 18 03:14:03 2024 GMT
            Not After : Sep 18 00:00:00 2027 GMT
        Subject: C = CN, O = sslTrus Inc., CN = sslTrus GCC R6 OV TLS CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3F:80:DD:B5:91:71:FC:25:E4:3E:9C:15:3C:BE:E5:04:63:70:3B:32
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 57A9CFB8EBBB0F1583AB496623D04135B5A1F220D3F31E33007327D3AC3159BC
    SPKI SHA256: 629A35EEFA18C5838C4F58628A33054405ECF0E9BFA014C34545599A19C7BC69
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### State Oil Atlas R45 SMIME CA 2022

- Subject: countryName=GB, organizationName=State Oil Ltd, commonName=State Oil Atlas R45 SMIME CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7C873CA70441C6812703B6CABE06B3AC
- SHA-256: 19B57472F46A480A721F03275647D4E5DF7FC790BCF7603DD5C8F9F35F7DE117
- SPKI SHA-256: 5DFBC148BF436F867977758A100D3ADDB16B5E9E57C21F555C7C8E49FDAD16D7
- Validity: 2022-06-15 to 2025-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/stateoilatlasr45smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:87:3c:a7:04:41:c6:81:27:03:b6:ca:be:06:b3:ac
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 15 12:00:00 2022 GMT
            Not After : Jun 15 00:00:00 2025 GMT
        Subject: C = GB, O = State Oil Ltd, CN = State Oil Atlas R45 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:4C:E4:B1:E0:22:A2:26:E3:4B:D9:3E:4D:1C:45:63:9C:D4:11:B3
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 19B57472F46A480A721F03275647D4E5DF7FC790BCF7603DD5C8F9F35F7DE117
    SPKI SHA256: 5DFBC148BF436F867977758A100D3ADDB16B5E9E57C21F555C7C8E49FDAD16D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### State Oil Atlas R45 SMIME CA 2022

- Subject: countryName=GB, organizationName=State Oil Ltd, commonName=State Oil Atlas R45 SMIME CA 2022
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 7EFC37487012FF89CCD36B856772E4B9
- SHA-256: DB8F5C248790FADCF1A3F405F1163C977B643056887CB6469D674AF5CEF46B5A
- SPKI SHA-256: 5DFBC148BF436F867977758A100D3ADDB16B5E9E57C21F555C7C8E49FDAD16D7
- Validity: 2023-06-28 to 2025-06-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/stateoilatlasr45smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:48:70:12:ff:89:cc:d3:6b:85:67:72:e4:b9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jun 28 03:31:15 2023 GMT
            Not After : Jun 15 00:00:00 2025 GMT
        Subject: C = GB, O = State Oil Ltd, CN = State Oil Atlas R45 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:4C:E4:B1:E0:22:A2:26:E3:4B:D9:3E:4D:1C:45:63:9C:D4:11:B3
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DB8F5C248790FADCF1A3F405F1163C977B643056887CB6469D674AF5CEF46B5A
    SPKI SHA256: 5DFBC148BF436F867977758A100D3ADDB16B5E9E57C21F555C7C8E49FDAD16D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SWIFT Atlas R3 SMIME CA 2022

- Subject: countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7C2A0C8515A90BE0D8B55F893871EEAA
- SHA-256: A4819D67CC975AC71BC9315FA08DFA5AFFB9A537D79A6865FEF574F28ED5B52B
- SPKI SHA-256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
- Validity: 2022-04-20 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/swiftatlasr3smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:2a:0c:85:15:a9:0b:e0:d8:b5:5f:89:38:71:ee:aa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 20 12:00:00 2022 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = SWIFT SC, CN = SWIFT Atlas R3 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:94:C8:22:83:DD:38:87:6A:D4:F5:9B:95:8E:94:1A:D4:57:A9:FA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A4819D67CC975AC71BC9315FA08DFA5AFFB9A537D79A6865FEF574F28ED5B52B
    SPKI SHA256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SWIFT Atlas R3 SMIME CA 2022

- Subject: countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 81140468A82FEE7426714D69AF815F20
- SHA-256: 26697DE995B1E8A60ED1A2A04A37DC2E8B3BCD4ED869FCC53C7F6C1D12323E52
- SPKI SHA-256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
- Validity: 2024-05-15 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/swiftatlasr3smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:14:04:68:a8:2f:ee:74:26:71:4d:69:af:81:5f:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May 15 03:24:28 2024 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = SWIFT SC, CN = SWIFT Atlas R3 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:94:C8:22:83:DD:38:87:6A:D4:F5:9B:95:8E:94:1A:D4:57:A9:FA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 26697DE995B1E8A60ED1A2A04A37DC2E8B3BCD4ED869FCC53C7F6C1D12323E52
    SPKI SHA256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SWIFT Atlas R3 SMIME CA 2022

- Subject: countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R3 SMIME CA 2022
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7EFC3779B984041CF4CBA2214864374B
- SHA-256: 65BAE54958A42CD00D08DA3AC63641B3D74F2B38C1EC14F29CFF13A7136E88A9
- SPKI SHA-256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
- Validity: 2023-06-28 to 2029-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/swiftatlasr3smimeca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:fc:37:79:b9:84:04:1c:f4:cb:a2:21:48:64:37:4b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 28 03:31:54 2023 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = BE, O = SWIFT SC, CN = SWIFT Atlas R3 SMIME CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:94:C8:22:83:DD:38:87:6A:D4:F5:9B:95:8E:94:1A:D4:57:A9:FA
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4146.10.3.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 65BAE54958A42CD00D08DA3AC63641B3D74F2B38C1EC14F29CFF13A7136E88A9
    SPKI SHA256: E807BE00B4FA1A1CB4D7276BA4617E48B2555EDE9AF6CF965FE70C98F6B1E0AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4146.10.3.2
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SWIFT Atlas R45 SMIME CA 2025

- Subject: countryName=BE, organizationName=SWIFT SC, commonName=SWIFT Atlas R45 SMIME CA 2025
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 8471F477AD78A887B7AD9A4A0474D75D
- SHA-256: 0AD9DA2A043684C081F870FDF855D14A22908792079F07AD729C992E6E95675D
- SPKI SHA-256: 26EDB93B8823CCBEDD730E549D227B22DF052D361E69210209D03E38882CA1EC
- Validity: 2025-10-15 to 2035-10-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/swiftatlasr45smimeca2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:71:f4:77:ad:78:a8:87:b7:ad:9a:4a:04:74:d7:5d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Oct 15 03:10:33 2025 GMT
            Not After : Oct 15 00:00:00 2035 GMT
        Subject: C = BE, O = SWIFT SC, CN = SWIFT Atlas R45 SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B2:D1:B8:BC:A5:6A:75:6D:ED:23:53:53:61:F2:E1:5D:4C:70:28:43
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0AD9DA2A043684C081F870FDF855D14A22908792079F07AD729C992E6E95675D
    SPKI SHA256: 26EDB93B8823CCBEDD730E549D227B22DF052D361E69210209D03E38882CA1EC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.21.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### tarquin

- Subject: countryName=US, stateOrProvinceName=OH, localityName=Oxford, organizationName=Miami University, organizationalUnitName=IT Services, commonName=tarquin
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000011C944A3290
- SHA-256: 8F4164D2EC68DCA94C19951B7E5AC44AEBEB57BE431CAEB2669687A2434C4F3A
- SPKI SHA-256: 663546E4333EAD8E3EA7F32279D39B5E4501691D3ADA212D695617E74B061252
- Validity: 2008-09-24 to 2018-09-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:1c:94:4a:32:90
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Sep 24 12:00:00 2008 GMT
            Not After : Sep 24 12:00:00 2018 GMT
        Subject: C = US, ST = OH, L = Oxford, O = Miami University, OU = IT Services, CN = tarquin
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                40:AA:B1:86:B7:0E:7E:9D:2D:38:26:4F:3E:56:E8:5F:D6:2E:16:E3
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  User Notice:
                    Explicit Text: http://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8F4164D2EC68DCA94C19951B7E5AC44AEBEB57BE431CAEB2669687A2434C4F3A
    SPKI SHA256: 663546E4333EAD8E3EA7F32279D39B5E4501691D3ADA212D695617E74B061252
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TK Elevator Atlas R6 DV CA 2021

- Subject: countryName=DE, organizationName=TK Elevator GmbH, commonName=TK Elevator Atlas R6 DV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7A925C3800D0B1A5241F309BBA3968B2
- SHA-256: 988D6B2D87BAF43821C4D304BE2B0E8F325DC17B7A220E934F5C5B7BADFF8E1C
- SPKI SHA-256: 993469F523244C6B1930E839663D909CEEBA48A1DCB22F6AFB1A9F0019580186
- Validity: 2021-08-18 to 2031-08-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/tkelevatoratlasr6dvca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:92:5c:38:00:d0:b1:a5:24:1f:30:9b:ba:39:68:b2
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 18 12:00:00 2021 GMT
            Not After : Aug 18 00:00:00 2031 GMT
        Subject: C = DE, O = TK Elevator GmbH, CN = TK Elevator Atlas R6 DV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:1D:52:92:E2:AF:F4:42:D8:4E:73:AA:FC:FE:F1:D6:A0:D4:1E:7F
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 988D6B2D87BAF43821C4D304BE2B0E8F325DC17B7A220E934F5C5B7BADFF8E1C
    SPKI SHA256: 993469F523244C6B1930E839663D909CEEBA48A1DCB22F6AFB1A9F0019580186
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Touchtech Intermediate CA

- Subject: countryName=IE, localityName=Dublin, organizationName=Touchtech Payments Limited, commonName=Touchtech Intermediate CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 48A402DFED623E979BF33D553899
- SHA-256: EF5CB9F6B52E79FCBC71937050D11B9D7E513654139B227D0FF251B250561F18
- SPKI SHA-256: 65DF9AE5BCD7E6E13D68D1E1B6AE1B2DAB063A0E3150B998EB59D75CF6125525
- Validity: 2016-09-21 to 2023-09-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:a4:02:df:ed:62:3e:97:9b:f3:3d:55:38:99
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Sep 21 00:00:00 2016 GMT
            Not After : Sep 21 00:00:00 2023 GMT
        Subject: C = IE, L = Dublin, O = Touchtech Payments Limited, CN = Touchtech Intermediate CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                9A:55:3D:9B:0A:81:EC:1C:B5:BA:D0:32:D1:A0:25:0E:C5:77:49:15
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EF5CB9F6B52E79FCBC71937050D11B9D7E513654139B227D0FF251B250561F18
    SPKI SHA256: 65DF9AE5BCD7E6E13D68D1E1B6AE1B2DAB063A0E3150B998EB59D75CF6125525
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Trafigura PTE DocuSign CA

- Subject: countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E707D1E2780DF02FF0DA58E2
- SHA-256: B53AB0BBFF07E6CD1A2C4FAB6B307686EA5C6C821DA84670727D1497FEBD5A6D
- SPKI SHA-256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
- Validity: 2018-01-17 to 2019-07-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.dtsservicos.com","email:.farringfordnv.com","email:.galena-invest.com","email:.impala-wl.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.portosudesteterminal.com","email:.puma-energy.com","email:.pumaenergy.com","email:.trafigura.com","email:.trafiguraperu.com","email:dtsholding.com","email:dtsservicos.com","email:farringfordnv.com","email:galena-invest.com","email:impala-wl.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:portosudesteterminal.com","email:puma-energy.com","email:pumaenergy.com","email:trafigura.com","email:trafiguraperu.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:d1:e2:78:0d:f0:2f:f0:da:58:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jan 17 00:00:00 2018 GMT
            Not After : Jul 17 00:00:00 2019 GMT
        Subject: C = SG, O = Trafigura PTE, CN = Trafigura PTE DocuSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:4A:02:FD:92:CE:6D:4A:03:F0:6E:70:D3:C3:FE:54:92:92:D9:FA
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.dtsholding.com
                  email:.dtsservicos.com
                  email:.farringfordnv.com
                  email:.galena-invest.com
                  email:.impala-wl.com
                  email:.impalaterminals.com
                  email:.matsamining.com
                  email:.portosudeste.com
                  email:.portosudesteterminal.com
                  email:.puma-energy.com
                  email:.pumaenergy.com
                  email:.trafigura.com
                  email:.trafiguraperu.com
                  email:dtsholding.com
                  email:dtsservicos.com
                  email:farringfordnv.com
                  email:galena-invest.com
                  email:impala-wl.com
                  email:impalaterminals.com
                  email:matsamining.com
                  email:portosudeste.com
                  email:portosudesteterminal.com
                  email:puma-energy.com
                  email:pumaenergy.com
                  email:trafigura.com
                  email:trafiguraperu.com
                  DNS:dtsholding.com
                  DNS:dtsservicos.com
                  DNS:farringfordnv.com
                  DNS:galena-invest.com
                  DNS:impala-wl.com
                  DNS:impalaterminals.com
                  DNS:matsamining.com
                  DNS:portosudeste.com
                  DNS:portosudesteterminal.com
                  DNS:puma-energy.com
                  DNS:pumaenergy.com
                  DNS:trafigura.com
                  DNS:trafiguraperu.com
                  DirName:O = Trafigura PTE
                  DirName:C = SG, O = Trafigura PTE
                  DirName:O = Trafigura Holdings Pte. Ltd.
                  DirName:C = SG, O = Trafigura Holdings Pte. Ltd.
                  DirName:O = Trafigura B.V.
                  DirName:C = NL, O = Trafigura B.V.
                  DirName:O = Trafigura Funding S.A.
                  DirName:C = LU, O = Trafigura Funding S.A.
                  DirName:O = Trafigura Holding GmbH
                  DirName:C = DE, O = Trafigura Holding GmbH
                  DirName:O = Puma Energy Holdings Malta Limited
                  DirName:C = MT, O = Puma Energy Holdings Malta Limited
                  DirName:O = Puma Energy Holdings Pte Ltd
                  DirName:C = SG, O = Puma Energy Holdings Pte Ltd
                  DirName:O = IWL Holding B.V.
                  DirName:C = NL, O = IWL Holding B.V.
                  DirName:O = Trafigura US Inc.
                  DirName:C = US, O = Trafigura US Inc.
                  DirName:O = Trafigura Trading LLC
                  DirName:C = US, O = Trafigura Trading LLC
                  DirName:O = Trafigura Trade Holdings B.V.
                  DirName:C = NL, O = Trafigura Trade Holdings B.V.
                  DirName:O = Trafigura Trade Investments B.V.
                  DirName:C = NL, O = Trafigura Trade Investments B.V.
                  DirName:O = Trafigura Pte. Ltd.
                  DirName:C = SG, O = Trafigura Pte. Ltd.
                  DirName:O = DTS Holdings Pte Ltd
                  DirName:C = SG, O = DTS Holdings Pte Ltd
                  DirName:O = Trafigura Ventures V B.V.
                  DirName:C = NL, O = Trafigura Ventures V B.V.
                  DirName:O = Galena Asset Management B.V.
                  DirName:C = NL, O = Galena Asset Management B.V.
                  DirName:O = Urion Holdings (Malta) Limited
                  DirName:C = MT, O = Urion Holdings (Malta) Limited
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B53AB0BBFF07E6CD1A2C4FAB6B307686EA5C6C821DA84670727D1497FEBD5A6D
    SPKI SHA256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.dtsservicos.com","email:.farringfordnv.com","email:.galena-invest.com","email:.impala-wl.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.portosudesteterminal.com","email:.puma-energy.com","email:.pumaenergy.com","email:.trafigura.com","email:.trafiguraperu.com","email:dtsholding.com","email:dtsservicos.com","email:farringfordnv.com","email:galena-invest.com","email:impala-wl.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:portosudesteterminal.com","email:puma-energy.com","email:pumaenergy.com","email:trafigura.com","email:trafiguraperu.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trafigura PTE DocuSign CA

- Subject: countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 751E3F7BA7249164DAA35382461B1C88
- SHA-256: EAA6069BC4E02AE20F000709AC98CB0C28DC0104EEC71D14354327FDC236ED1F
- SPKI SHA-256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
- Validity: 2019-07-16 to 2019-09-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.galena-invest.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.pumaenergy.com","email:.trafigura.com","email:dtsholding.com","email:galena-invest.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:pumaenergy.com","email:trafigura.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:1e:3f:7b:a7:24:91:64:da:a3:53:82:46:1b:1c:88
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Jul 16 00:00:00 2019 GMT
            Not After : Sep  1 00:00:00 2019 GMT
        Subject: C = SG, O = Trafigura PTE, CN = Trafigura PTE DocuSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:4A:02:FD:92:CE:6D:4A:03:F0:6E:70:D3:C3:FE:54:92:92:D9:FA
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.dtsholding.com
                  email:.galena-invest.com
                  email:.impalaterminals.com
                  email:.matsamining.com
                  email:.portosudeste.com
                  email:.pumaenergy.com
                  email:.trafigura.com
                  email:dtsholding.com
                  email:galena-invest.com
                  email:impalaterminals.com
                  email:matsamining.com
                  email:portosudeste.com
                  email:pumaenergy.com
                  email:trafigura.com
                  DNS:dtsholding.com
                  DNS:galena-invest.com
                  DNS:impalaterminals.com
                  DNS:matsamining.com
                  DNS:portosudeste.com
                  DNS:pumaenergy.com
                  DNS:trafigura.com
                  DirName:C = SG, O = Trafigura PTE Ltd
                  DirName:C = SG, O = Puma Energy Holdings Pte Ltd
                  DirName:C = NL, O = IWL Holding B.V.
                  DirName:C = SG, O = DTS Holdings Pte Ltd
                  DirName:C = NL, O = Galena Asset Management B.V.
                  DirName:C = SG, O = Trafigura PTE
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EAA6069BC4E02AE20F000709AC98CB0C28DC0104EEC71D14354327FDC236ED1F
    SPKI SHA256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.galena-invest.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.pumaenergy.com","email:.trafigura.com","email:dtsholding.com","email:galena-invest.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:pumaenergy.com","email:trafigura.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trafigura PTE DocuSign CA

- Subject: countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E528B4BD7D748C2AEB885C2E
- SHA-256: 0C3B69672EBABE1F96CAF3CBE598F7747C01F78014AF651191950D673FD91784
- SPKI SHA-256: B58DE5C166FC0B71E97BD039D4DF17EF5EB20E4743B0D6FE50D872A1DEFE458B
- Validity: 2017-09-20 to 2020-09-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.dtsservicos.com","email:.farringfordnv.com","email:.galena-invest.com","email:.impala-wl.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.portosudesteterminal.com","email:.puma-energy.com","email:.pumaenergy.com","email:.trafigura.com","email:.trafiguraperu.com","email:dtsholding.com","email:dtsservicos.com","email:farringfordnv.com","email:galena-invest.com","email:impala-wl.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:portosudesteterminal.com","email:puma-energy.com","email:pumaenergy.com","email:trafigura.com","email:trafiguraperu.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e5:28:b4:bd:7d:74:8c:2a:eb:88:5c:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Sep 20 00:00:00 2017 GMT
            Not After : Sep 20 00:00:00 2020 GMT
        Subject: C = SG, O = Trafigura PTE, CN = Trafigura PTE DocuSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E8:58:49:56:A6:72:0E:19:8F:18:2E:1B:AB:66:2C:78:1D:AE:0C:39
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.dtsholding.com
                  email:.dtsservicos.com
                  email:.farringfordnv.com
                  email:.galena-invest.com
                  email:.impala-wl.com
                  email:.impalaterminals.com
                  email:.matsamining.com
                  email:.portosudeste.com
                  email:.portosudesteterminal.com
                  email:.puma-energy.com
                  email:.pumaenergy.com
                  email:.trafigura.com
                  email:.trafiguraperu.com
                  email:dtsholding.com
                  email:dtsservicos.com
                  email:farringfordnv.com
                  email:galena-invest.com
                  email:impala-wl.com
                  email:impalaterminals.com
                  email:matsamining.com
                  email:portosudeste.com
                  email:portosudesteterminal.com
                  email:puma-energy.com
                  email:pumaenergy.com
                  email:trafigura.com
                  email:trafiguraperu.com
                  DNS:dtsholding.com
                  DNS:dtsservicos.com
                  DNS:farringfordnv.com
                  DNS:galena-invest.com
                  DNS:impala-wl.com
                  DNS:impalaterminals.com
                  DNS:matsamining.com
                  DNS:portosudeste.com
                  DNS:portosudesteterminal.com
                  DNS:puma-energy.com
                  DNS:pumaenergy.com
                  DNS:trafigura.com
                  DNS:trafiguraperu.com
                  DirName:O = Trafigura PTE
                  DirName:C = SG, O = Trafigura PTE
                  DirName:O = Trafigura Holdings Pte. Ltd.
                  DirName:C = SG, O = Trafigura Holdings Pte. Ltd.
                  DirName:O = Trafigura B.V.
                  DirName:C = NL, O = Trafigura B.V.
                  DirName:O = Trafigura Funding S.A.
                  DirName:C = LU, O = Trafigura Funding S.A.
                  DirName:O = Trafigura Holding GmbH
                  DirName:C = DE, O = Trafigura Holding GmbH
                  DirName:O = Puma Energy Holdings Malta Limited
                  DirName:C = MT, O = Puma Energy Holdings Malta Limited
                  DirName:O = Puma Energy Holdings Pte Ltd
                  DirName:C = SG, O = Puma Energy Holdings Pte Ltd
                  DirName:O = IWL Holding B.V.
                  DirName:C = NL, O = IWL Holding B.V.
                  DirName:O = Trafigura US Inc.
                  DirName:C = US, O = Trafigura US Inc.
                  DirName:O = Trafigura Trading LLC
                  DirName:C = US, O = Trafigura Trading LLC
                  DirName:O = Trafigura Trade Holdings B.V.
                  DirName:C = NL, O = Trafigura Trade Holdings B.V.
                  DirName:O = Trafigura Trade Investments B.V.
                  DirName:C = NL, O = Trafigura Trade Investments B.V.
                  DirName:O = Trafigura Pte. Ltd.
                  DirName:C = SG, O = Trafigura Pte. Ltd.
                  DirName:O = DTS Holdings Pte Ltd
                  DirName:C = SG, O = DTS Holdings Pte Ltd
                  DirName:O = Trafigura Ventures V B.V.
                  DirName:C = NL, O = Trafigura Ventures V B.V.
                  DirName:O = Galena Asset Management B.V.
                  DirName:C = NL, O = Galena Asset Management B.V.
                  DirName:O = Urion Holdings (Malta) Limited
                  DirName:C = MT, O = Urion Holdings (Malta) Limited
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0C3B69672EBABE1F96CAF3CBE598F7747C01F78014AF651191950D673FD91784
    SPKI SHA256: B58DE5C166FC0B71E97BD039D4DF17EF5EB20E4743B0D6FE50D872A1DEFE458B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.dtsservicos.com","email:.farringfordnv.com","email:.galena-invest.com","email:.impala-wl.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.portosudesteterminal.com","email:.puma-energy.com","email:.pumaenergy.com","email:.trafigura.com","email:.trafiguraperu.com","email:dtsholding.com","email:dtsservicos.com","email:farringfordnv.com","email:galena-invest.com","email:impala-wl.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:portosudesteterminal.com","email:puma-energy.com","email:pumaenergy.com","email:trafigura.com","email:trafiguraperu.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trafigura PTE DocuSign CA

- Subject: countryName=SG, organizationName=Trafigura PTE, commonName=Trafigura PTE DocuSign CA
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 75A8B9B9E27BCCFF37CC2D84C38F22B5
- SHA-256: C853240A6C0AB6B4240F49143ED7143AFE4E14949920A8D135E1C8680FDB11FA
- SPKI SHA-256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
- Validity: 2019-08-21 to 2019-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.galena-invest.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.pumaenergy.com","email:.trafigura.com","email:dtsholding.com","email:galena-invest.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:pumaenergy.com","email:trafigura.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:a8:b9:b9:e2:7b:cc:ff:37:cc:2d:84:c3:8f:22:b5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Aug 21 00:00:00 2019 GMT
            Not After : Dec 31 23:59:59 2019 GMT
        Subject: C = SG, O = Trafigura PTE, CN = Trafigura PTE DocuSign CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                04:4A:02:FD:92:CE:6D:4A:03:F0:6E:70:D3:C3:FE:54:92:92:D9:FA
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.dtsholding.com
                  email:.galena-invest.com
                  email:.impalaterminals.com
                  email:.matsamining.com
                  email:.portosudeste.com
                  email:.pumaenergy.com
                  email:.trafigura.com
                  email:dtsholding.com
                  email:galena-invest.com
                  email:impalaterminals.com
                  email:matsamining.com
                  email:portosudeste.com
                  email:pumaenergy.com
                  email:trafigura.com
                  DNS:dtsholding.com
                  DNS:galena-invest.com
                  DNS:impalaterminals.com
                  DNS:matsamining.com
                  DNS:portosudeste.com
                  DNS:pumaenergy.com
                  DNS:trafigura.com
                  DirName:C = SG, O = Trafigura PTE Ltd
                  DirName:C = SG, O = Puma Energy Holdings Pte Ltd
                  DirName:C = NL, O = IWL Holding B.V.
                  DirName:C = SG, O = DTS Holdings Pte Ltd
                  DirName:C = NL, O = Galena Asset Management B.V.
                  DirName:C = SG, O = Trafigura PTE
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C853240A6C0AB6B4240F49143ED7143AFE4E14949920A8D135E1C8680FDB11FA
    SPKI SHA256: 42F3DB0155414C151C201690C9076BF0FCB8F540216DD4C23BC551F25D9EEB0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.dtsholding.com","email:.galena-invest.com","email:.impalaterminals.com","email:.matsamining.com","email:.portosudeste.com","email:.pumaenergy.com","email:.trafigura.com","email:dtsholding.com","email:galena-invest.com","email:impalaterminals.com","email:matsamining.com","email:portosudeste.com","email:pumaenergy.com","email:trafigura.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trafigura PTE Ltd Atlas R45 SMIME CA 2020

- Subject: countryName=SG, organizationName=Trafigura PTE Ltd, commonName=Trafigura PTE Ltd Atlas R45 SMIME CA 2020
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Secure Mail Root R45
- Serial: 78031843A383FF3F4AC7B850F85857D3
- SHA-256: 36FCE16CC976727765DF5E9FADB12C544D704C35150D1F17DDE1A42A85B88BE4
- SPKI SHA-256: 658D65175A3152D5953BFB408F1F593761A23FD206974CA2197F2731B6ED0520
- Validity: 2020-07-28 to 2030-07-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/ca/trafiguraatlasr45smimeca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- CRL DP: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:03:18:43:a3:83:ff:3f:4a:c7:b8:50:f8:58:57:d3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Secure Mail Root R45
        Validity
            Not Before: Jul 28 00:00:00 2020 GMT
            Not After : Jul 28 00:00:00 2030 GMT
        Subject: C = SG, O = Trafigura PTE Ltd, CN = Trafigura PTE Ltd Atlas R45 SMIME CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E5:E0:90:F1:9B:95:77:8D:AB:AC:A5:F7:4A:A7:C4:51:3B:8F:B9:85
            X509v3 Authority Key Identifier:
                A0:93:15:28:6E:EE:8F:08:B2:35:C6:9E:62:79:74:A7:B1:0E:2B:7B
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/smimerootr45
                CA Issuers - URI:http://secure.globalsign.com/cacert/smimerootr45.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/smimerootr45.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 36FCE16CC976727765DF5E9FADB12C544D704C35150D1F17DDE1A42A85B88BE4
    SPKI SHA256: 658D65175A3152D5953BFB408F1F593761A23FD206974CA2197F2731B6ED0520
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6
- Certificate Policies: 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp.globalsign.com/smimerootr45
- AIA CA Issuers: http://secure.globalsign.com/cacert/smimerootr45.crt
- CRL Distribution Points: http://crl.globalsign.com/smimerootr45.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trafigura PTE Ltd S/MIME ICA 2020

- Subject: countryName=SG, organizationName=Trafigura PTE Ltd, commonName=Trafigura PTE Ltd S/MIME ICA 2020
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7653FE34392E2DD7A2300F359B6E50FC
- SHA-256: 5E7FCB9C97BDA56993B1658D120232761D665A3644534300FA6A5BEC5E0D5795
- SPKI SHA-256: 33B23353BE951700B28B2B3891D07DB3DAD3B5D1D17208AF6A68CB8F693389AD
- Validity: 2020-01-22 to 2029-03-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:53:fe:34:39:2e:2d:d7:a2:30:0f:35:9b:6e:50:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 22 00:00:00 2020 GMT
            Not After : Mar 18 00:00:00 2029 GMT
        Subject: C = SG, O = Trafigura PTE Ltd, CN = Trafigura PTE Ltd S/MIME ICA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, OCSP Signing
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F9:76:AB:89:D7:42:0D:EA:4C:DE:38:6B:C6:3B:86:4A:9C:36:E9:66
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.95
                Policy: 1.3.6.1.4.1.4146.1.40
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5E7FCB9C97BDA56993B1658D120232761D665A3644534300FA6A5BEC5E0D5795
    SPKI SHA256: 33B23353BE951700B28B2B3891D07DB3DAD3B5D1D17208AF6A68CB8F693389AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.95, 1.3.6.1.4.1.4146.1.40
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Trusted Root CA G2

- Subject: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Serial: 04000000000136E93A3AB3
- SHA-256: 6E32A35B599E9087BB1AB35CE73022EC2E26AF34BE388919419C95700CD8E7FB
- SPKI SHA-256: 5BAEAD3F8C1E3E800EF98F148D4960CAAA8533B8EA2091D54FBA48CE66173AD2
- Validity: 2012-04-25 to 2027-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- CRL DP: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:36:e9:3a:3a:b3
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Apr 25 11:00:00 2012 GMT
            Not After : Apr 25 11:00:00 2027 GMT
        Subject: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Subject Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr1
            X509v3 Authority Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6E32A35B599E9087BB1AB35CE73022EC2E26AF34BE388919419C95700CD8E7FB
    SPKI SHA256: 5BAEAD3F8C1E3E800EF98F148D4960CAAA8533B8EA2091D54FBA48CE66173AD2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### Trusted Root CA SHA256 G2

- Subject: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000136E982395D
- SHA-256: 01FD73EF5E70F526FC9C11F65FE2EE6F7125B3693949227FFD8E459E583C458A
- SPKI SHA-256: 1C75AC70747E99745E30A0516710AFA8483AC03BFA1C06CFCCA37B3652EFAB87
- Validity: 2012-04-25 to 2027-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:36:e9:82:39:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 25 11:00:00 2012 GMT
            Not After : Apr 25 11:00:00 2027 GMT
        Subject: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Subject Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r3.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr3
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 01FD73EF5E70F526FC9C11F65FE2EE6F7125B3693949227FFD8E459E583C458A
    SPKI SHA256: 1C75AC70747E99745E30A0516710AFA8483AC03BFA1C06CFCCA37B3652EFAB87
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### Trusted Root nonTLS CA SHA256 G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root nonTLS CA SHA256 G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 77BD0D7548681C2F7229ECC29BF0E7DA
- SHA-256: 3A30D4A3043F195609E30F747754699CC6CC97E1F5FCB83DE87E659E579E39AD
- SPKI SHA-256: 2A9B6520BDD74B9D84978CE679F1C1442D19F0D6AA02D5ADD3CCE3EEAADAD8AB
- Validity: 2020-07-05 to 2027-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/trustrootnontlssha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:75:48:68:1c:2f:72:29:ec:c2:9b:f0:e7:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Apr 25 11:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = Trusted Root nonTLS CA SHA256 G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                29:F1:5C:83:62:5B:F7:3F:1C:D6:12:05:2B:49:A0:9B:26:AB:B3:99
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3A30D4A3043F195609E30F747754699CC6CC97E1F5FCB83DE87E659E579E39AD
    SPKI SHA256: 2A9B6520BDD74B9D84978CE679F1C1442D19F0D6AA02D5ADD3CCE3EEAADAD8AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, 1.3.6.1.4.1.311.10.3.4.1, 1.3.6.1.4.1.311.10.3.11, 1.3.6.1.4.1.311.20.2.1, Microsoft Smartcard Login, 1.3.6.1.4.1.311.21.19, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.21.6, 1.3.6.1.4.1.311.10.3.12, IPSec User, 1.3.6.1.5.5.7.3.14
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Trusted Root TLS CA SHA256 G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R3, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 77BD0D753F2E19601BD54E0A02444676
- SHA-256: 91F19CE503C9FE7FF9587D8EFBEF7315AAEE77DC2D14526126493B4AD6FE801F
- SPKI SHA-256: 84C74893F421F3BC24863B98DEF5980BCE72B822AB11F6E2F5BDE3EF124D3DE7
- Validity: 2020-07-05 to 2027-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/trustroottlssha2g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- CRL DP: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:75:3f:2e:19:60:1b:d5:4e:0a:02:44:46:76
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Apr 25 11:00:00 2027 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            X509v3 Authority Key Identifier:
                8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr3
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91F19CE503C9FE7FF9587D8EFBEF7315AAEE77DC2D14526126493B4AD6FE801F
    SPKI SHA256: 84C74893F421F3BC24863B98DEF5980BCE72B822AB11F6E2F5BDE3EF124D3DE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr3
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r3.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TUI CA for CoSign

- Subject: countryName=NL, commonName=TUI CA for CoSign, organizationName=TUI Nederland N.V.
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 47699DAFE3971F1CFD6E0BB1F9FE
- SHA-256: F85C48B1363A02E29A7B5A45250CC6050F9579338EA3E6AE76F0B3611DEDC0F2
- SPKI SHA-256: DF4ED3089F1A3DC652075D24F6EB8A3E89D257C1E3BCC4E6067C119DD365AAE3
- Validity: 2015-12-15 to 2018-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100, 1.3.6.1.4.1.17277.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.tui.nl","email:tui.nl"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:69:9d:af:e3:97:1f:1c:fd:6e:0b:b1:f9:fe
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Dec 15 00:00:00 2015 GMT
            Not After : Dec 15 00:00:00 2018 GMT
        Subject: C = NL, CN = TUI CA for CoSign, O = TUI Nederland N.V.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AF:74:EF:4B:BC:9E:7C:2B:CF:18:98:22:99:76:A8:64:5C:15:67:1B
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.tui.nl
                  email:tui.nl
                  DNS:tui.nl
                  DirName:O = TUI Nederland Holding N.V.
                  DirName:C = NL, O = TUI Nederland Holding N.V.
                  DirName:O = TUI Nederland N.V.
                  DirName:C = NL, O = TUI Nederland N.V.
                  DirName:O = TUI Airlines Nederland B.V.
                  DirName:C = NL, O = TUI Airlines Nederland B.V.
                  DirName:O = Cheqqer B.V.
                  DirName:C = NL, O = Cheqqer B.V.
                  DirName:O = Kras B.V.
                  DirName:C = NL, O = Kras B.V.
                  DirName:O = Tec4Jets B.V.
                  DirName:C = NL, O = Tec4Jets B.V.
                  DirName:O = TUI Curacao N.V.
                  DirName:C = CW, O = TUI Curacao N.V.
                  DirName:O = Jetair NV
                  DirName:C = BE, O = Jetair NV
                  DirName:O = TUI Airlines Belgium NV
                  DirName:C = BE, O = TUI Airlines Belgium NV
                  DirName:O = Jetaircenter NV
                  DirName:C = BE, O = Jetaircenter NV
                  DirName:O = TUI Travel Belgium NV
                  DirName:C = BE, O = TUI Travel Belgium NV
                  DirName:O = Jetair Travel Distribution NV
                  DirName:C = BE, O = Jetair Travel Distribution NV
                  DirName:O = Jetair Real Estate NV
                  DirName:C = BE, O = Jetair Real Estate NV
                  DirName:O = Tec4Jets NV
                  DirName:C = BE, O = Tec4Jets NV
                  DirName:O = TUIfly Academy Brussels NV
                  DirName:C = BE, O = TUIfly Academy Brussels NV
                  DirName:O = Societe d investissement Aerien SA
                  DirName:C = MA, O = Societe d investissement Aerien SA
                  DirName:O = Groupement Touristique International SA
                  DirName:C = FR, O = Groupement Touristique International SA
                  DirName:O = TUI France SAS
                  DirName:C = FR, O = TUI France SAS
                  DirName:O = CORSAIR S.A.
                  DirName:C = FR, O = CORSAIR S.A.
                  DirName:O = Skibound France SARL
                  DirName:C = FR, O = Skibound France SARL
                  DirName:O = Molay Travel SARL
                  DirName:C = FR, O = Molay Travel SARL
                  DirName:O = Student City SARL
                  DirName:C = FR, O = Student City SARL
                  DirName:O = Lodges and Mountain Hotels SARL
                  DirName:C = FR, O = Lodges and Mountain Hotels SARL
                  DirName:O = Sunsail SAS
                  DirName:C = FR, O = Sunsail SAS
                  DirName:O = Moorings Yachting SASU
                  DirName:C = FR, O = Moorings Yachting SASU
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
                Policy: 1.3.6.1.4.1.2774.2.100
                Policy: 1.3.6.1.4.1.17277.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F85C48B1363A02E29A7B5A45250CC6050F9579338EA3E6AE76F0B3611DEDC0F2
    SPKI SHA256: DF4ED3089F1A3DC652075D24F6EB8A3E89D257C1E3BCC4E6067C119DD365AAE3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.60, 1.3.6.1.4.1.2774.2.100, 1.3.6.1.4.1.17277.1.1
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.tui.nl","email:tui.nl"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ubizen CA

- Subject: commonName=Ubizen CA, countryName=BE, organizationName=Ubizen nv
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 040000000001163E9EA34B
- SHA-256: DAB0E91941D4FF12E8A048653D0E0979A792DF21A0618156139DDA4D669B172A
- SPKI SHA-256: 813C7A6BBC76D52A8CE95CABCF0D5AAF392278CEF1288E9B5DFB01026B5B5697
- Validity: 2004-08-06 to 2022-08-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:16:3e:9e:a3:4b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Aug  6 13:00:00 2004 GMT
            Not After : Aug  6 13:00:00 2022 GMT
        Subject: CN = Ubizen CA, C = BE, O = Ubizen nv
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DB:7C:78:E3:51:CC:97:41:ED:D6:57:D9:52:7E:10:14:8E:AD:7A:2D
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DAB0E91941D4FF12E8A048653D0E0979A792DF21A0618156139DDA4D669B172A
    SPKI SHA256: 813C7A6BBC76D52A8CE95CABCF0D5AAF392278CEF1288E9B5DFB01026B5B5697
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### Valid Certificadora Digital AlphaSSL CA 2018

- Subject: countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID AlphaSSL, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital AlphaSSL CA 2018
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01EE5F16A8C7560CC171482FD2
- SHA-256: 385135AB18DD190A03BCC0601ACA6F83CEA366642791EBE0A2FDB059C2F7750A
- SPKI SHA-256: B1794825E24538EBCDAAB81F007339E78E285FFC923E7AD652DF0CEDE145D013
- Validity: 2018-09-19 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:16:a8:c7:56:0c:c1:71:48:2f:d2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, ST = S\C3\83O PAULO, L = S\C3\83O PAULO, OU = VALID AlphaSSL, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital AlphaSSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:07:EE:19:0A:28:60:48:A6:CE:58:AB:E7:86:AC:7D:C5:46:26:32
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10.10
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 385135AB18DD190A03BCC0601ACA6F83CEA366642791EBE0A2FDB059C2F7750A
    SPKI SHA256: B1794825E24538EBCDAAB81F007339E78E285FFC923E7AD652DF0CEDE145D013
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10.10, 2.23.140.1.2.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital AlphaSSL CA 2018

- Subject: countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital AlphaSSL CA 2018
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D983AF99B0576813DB5A37F61C6
- SHA-256: 04DE47A9CDD3091CFC5EF6AAA3B7D4B53E13C4D4DC02364F6C0B408742EC3C76
- SPKI SHA-256: B1794825E24538EBCDAAB81F007339E78E285FFC923E7AD652DF0CEDE145D013
- Validity: 2020-07-05 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/validalphasslca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:98:3a:f9:9b:05:76:81:3d:b5:a3:7f:61:c6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital AlphaSSL CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:07:EE:19:0A:28:60:48:A6:CE:58:AB:E7:86:AC:7D:C5:46:26:32
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 04DE47A9CDD3091CFC5EF6AAA3B7D4B53E13C4D4DC02364F6C0B408742EC3C76
    SPKI SHA256: B1794825E24538EBCDAAB81F007339E78E285FFC923E7AD652DF0CEDE145D013
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL DV CA 2018

- Subject: countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL DV CA 2018
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D9BA66E82FF5A90FCEF083FF079
- SHA-256: FCF26FBC1B2A25A76AB4EA92B2CBEF367E0131091C802DA49898F78AE54B30F8
- SPKI SHA-256: D943D4383990C4C66CBC522C2BB26074548F63E919FEA28FFBB6973E1D7F6F1F
- Validity: 2020-07-05 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/validssldvca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:9b:a6:6e:82:ff:5a:90:fc:ef:08:3f:f0:79
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL DV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:E0:19:3C:A2:63:99:C7:A2:AB:A7:2D:1A:FC:64:F6:4A:BF:43:0F
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FCF26FBC1B2A25A76AB4EA92B2CBEF367E0131091C802DA49898F78AE54B30F8
    SPKI SHA256: D943D4383990C4C66CBC522C2BB26074548F63E919FEA28FFBB6973E1D7F6F1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL DV CA 2018

- Subject: countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL DV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL DV CA 2018
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01EE5F16B3D8DB5E14BFA291D4
- SHA-256: 62B48F51E5868676FD79B9DD9DB98BA928494BA734403C583393C42CE00AD448
- SPKI SHA-256: D943D4383990C4C66CBC522C2BB26074548F63E919FEA28FFBB6973E1D7F6F1F
- Validity: 2018-09-19 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:16:b3:d8:db:5e:14:bf:a2:91:d4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, ST = S\C3\83O PAULO, L = S\C3\83O PAULO, OU = VALID SSL DV, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL DV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:E0:19:3C:A2:63:99:C7:A2:AB:A7:2D:1A:FC:64:F6:4A:BF:43:0F
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.10
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 62B48F51E5868676FD79B9DD9DB98BA928494BA734403C583393C42CE00AD448
    SPKI SHA256: D943D4383990C4C66CBC522C2BB26074548F63E919FEA28FFBB6973E1D7F6F1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.10, 2.23.140.1.2.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL EV CA 2018

- Subject: countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL EV CA 2018
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0DA4FD3C75158E48DE98EF2A72A6
- SHA-256: 8AEFEBD88BE87A30B19C60C5BD0FB5E9FBCD15D5582D5FC9A7499578D68DCEC0
- SPKI SHA-256: 16FBEC7FE4A315C35386E9912947E1E19B33E19B17AA4A164E22EDEE24FC0C1A
- Validity: 2020-07-05 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/validsslevca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:a4:fd:3c:75:15:8e:48:de:98:ef:2a:72:a6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL EV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:D8:A2:F6:91:98:72:8D:75:E5:6E:0F:DE:4B:DD:6B:89:6A:EC:AE
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8AEFEBD88BE87A30B19C60C5BD0FB5E9FBCD15D5582D5FC9A7499578D68DCEC0
    SPKI SHA256: 16FBEC7FE4A315C35386E9912947E1E19B33E19B17AA4A164E22EDEE24FC0C1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL EV CA 2018

- Subject: countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL EV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL EV CA 2018
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01EE5F170560F346567E623D08
- SHA-256: 27FA1BE4F4B56A142A47A56A7E94B72502059B4022E4623E748CA1EF151CF222
- SPKI SHA-256: 16FBEC7FE4A315C35386E9912947E1E19B33E19B17AA4A164E22EDEE24FC0C1A
- Validity: 2018-09-19 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:17:05:60:f3:46:56:7e:62:3d:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, ST = S\C3\83O PAULO, L = S\C3\83O PAULO, OU = VALID SSL EV, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL EV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A9:D8:A2:F6:91:98:72:8D:75:E5:6E:0F:DE:4B:DD:6B:89:6A:EC:AE
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 27FA1BE4F4B56A142A47A56A7E94B72502059B4022E4623E748CA1EF151CF222
    SPKI SHA256: 16FBEC7FE4A315C35386E9912947E1E19B33E19B17AA4A164E22EDEE24FC0C1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.1, 2.23.140.1.1
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL OV CA 2018

- Subject: countryName=BR, stateOrProvinceName=SÃO PAULO, localityName=SÃO PAULO, organizationalUnitName=VALID SSL OV, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL OV CA 2018
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01EE5F16FF9CE51B7BE7DCB014
- SHA-256: 600E97601B0BBC5F056F04EEF671EF580F2A8583C6D2D3FAD401B9D820AA8836
- SPKI SHA-256: 38E9697151AA2DF65F976ACAECC756D857FA4CC8550FE3F045FDD7B45514B4BC
- Validity: 2018-09-19 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:ee:5f:16:ff:9c:e5:1b:7b:e7:dc:b0:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Sep 19 00:00:00 2018 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, ST = S\C3\83O PAULO, L = S\C3\83O PAULO, OU = VALID SSL OV, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL OV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                10:B0:14:80:D5:59:47:49:AB:CB:DF:89:8B:1D:0A:8B:A6:66:58:4F
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 600E97601B0BBC5F056F04EEF671EF580F2A8583C6D2D3FAD401B9D820AA8836
    SPKI SHA256: 38E9697151AA2DF65F976ACAECC756D857FA4CC8550FE3F045FDD7B45514B4BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/trustrootsha2g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Valid Certificadora Digital SSL OV CA 2018

- Subject: countryName=BR, organizationName=VALID CERTIFICADORA DIGITAL, commonName=Valid Certificadora Digital SSL OV CA 2018
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=Trusted Root TLS CA SHA256 G3
- Serial: 77BD0D9FF6170762CCBFB1558A1F106D
- SHA-256: 6B4F9DE13678846730D50E914A08E7BE9B742CA3A0A7D5393367830B93A6F553
- SPKI SHA-256: 38E9697151AA2DF65F976ACAECC756D857FA4CC8550FE3F045FDD7B45514B4BC
- Validity: 2020-07-05 to 2023-09-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/validsslovca2018.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- CRL DP: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:bd:0d:9f:f6:17:07:62:cc:bf:b1:55:8a:1f:10:6d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = Trusted Root TLS CA SHA256 G3
        Validity
            Not Before: Jul  5 00:00:00 2020 GMT
            Not After : Sep 19 00:00:00 2023 GMT
        Subject: C = BR, O = VALID CERTIFICADORA DIGITAL, CN = Valid Certificadora Digital SSL OV CA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                10:B0:14:80:D5:59:47:49:AB:CB:DF:89:8B:1D:0A:8B:A6:66:58:4F
            X509v3 Authority Key Identifier:
                DE:4F:D7:DD:27:AE:D5:7F:58:81:E1:2C:47:AC:23:B7:C6:7B:57:EF
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/trustroottlssha2g3
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/trustroottlssha2g3.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.20
                  CPS: https://www.globalsign.com/repository/
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6B4F9DE13678846730D50E914A08E7BE9B742CA3A0A7D5393367830B93A6F553
    SPKI SHA256: 38E9697151AA2DF65F976ACAECC756D857FA4CC8550FE3F045FDD7B45514B4BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.20, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.globalsign.com/trustroottlssha2g3
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustroottlssha2g3.crt
- CRL Distribution Points: http://crl.globalsign.com/trustroottlssha2g3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Virginia Tech Global Qualified Server CA

- Subject: countryName=US, stateOrProvinceName=Virginia, localityName=Blacksburg, organizationalUnitName=Global Qualified Server CA, organizationName=Virginia Polytechnic Institute and State University, commonName=Virginia Tech Global Qualified Server CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA G2
- Serial: 22AA727FF6281A0BC773C1E20C0C4023CA
- SHA-256: 1B930549AB8CD950A55C04D383C59E3E27908492332DF945BD0EEA6AF61EE48F
- SPKI SHA-256: 69BAF003CD972FE730461C1CD4B5904CA415EEB24ECE60372E5936FE1BB3CCF9
- Validity: 2012-12-13 to 2017-12-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- CRL DP: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:aa:72:7f:f6:28:1a:0b:c7:73:c1:e2:0c:0c:40:23:ca
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA G2
        Validity
            Not Before: Dec 13 00:00:00 2012 GMT
            Not After : Dec 13 00:00:00 2017 GMT
        Subject: C = US, ST = Virginia, L = Blacksburg, OU = Global Qualified Server CA, O = Virginia Polytechnic Institute and State University, CN = Virginia Tech Global Qualified Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints:
                Permitted:
                  DNS:3dblacksburg.org
                  DNS:acceleratevirginia.com
                  DNS:acceleratevirginia.org
                  DNS:acvcp.org
                  DNS:bev.net
                  DNS:bev.org
                  DNS:cligs.org
                  DNS:cmiweb.org
                  DNS:easternbrooktrout.net
                  DNS:easternbrooktrout.org
                  DNS:ecorridors.info
                  DNS:edgarresearch.org
                  DNS:get-educated.com
                  DNS:get-educated.info
                  DNS:geteducated.net
                  DNS:get-educated.net
                  DNS:geteducated.org
                  DNS:get-educated.org
                  DNS:hokieclub.com
                  DNS:hokiephoto.com
                  DNS:hokieshop.com
                  DNS:hokiesports.com
                  DNS:hokietickets.com
                  DNS:hotelroanoke.com
                  DNS:humanwildlife.org
                  DNS:innatvirginiatech.com
                  DNS:ischp2011.org
                  DNS:landrehab.org
                  DNS:nationaltireresearchcenter.com
                  DNS:networkvirginia.net
                  DNS:pdrcvt.com
                  DNS:petedyerivercourse.com
                  DNS:radioiq.org
                  DNS:rivercoursegolf.com
                  DNS:sdimi.org
                  DNS:sovamotion.com
                  DNS:sustainable-biomaterials.com
                  DNS:sustainable-biomaterials.org
                  DNS:thisisthefuture.com
                  DNS:this-is-the-future.com
                  DNS:thisisthefuture.net
                  DNS:this-is-the-future.net
                  DNS:vads.org
                  DNS:valeaf.org
                  DNS:vatech.info
                  DNS:vatech.mobi
                  DNS:vatechlifelonglearning.com
                  DNS:vatechlifelonglearning.net
                  DNS:vatechlifelonglearning.org
                  DNS:vcom.edu
                  DNS:virginiaview.net
                  DNS:virginiapolytechnicinstituteandstateuniversity.com
                  DNS:virginiapolytechnicinstituteandstateuniversity.info
                  DNS:virginiapolytechnicinstituteandstateuniversity.net
                  DNS:virginiapolytechnicinstituteandstateuniversity.org
                  DNS:virginiapublicradio.org
                  DNS:virginiatech.edu
                  DNS:virginiatech.mobi
                  DNS:virginiatechfoundation.org
                  DNS:vt.edu
                  DNS:vtarc.org
                  DNS:vt-arc.org
                  DNS:vtcrc.com
                  DNS:vtip.org
                  DNS:vtlean.org
                  DNS:vtknowledgeworks.com
                  DNS:vtlifelonglearning.com
                  DNS:vtlifelonglearning.net
                  DNS:vtlifelonglearning.org
                  DNS:vtsportsmedia.com
                  DNS:vtwei.com
                  DNS:wiwatwerc.com
                  DNS:wvtf.org
                  email:vt.edu
                  DirName:C = US, ST = Virginia, L = Blacksburg, O = Virginia Polytechnic Institute and State University
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootg2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootg2.crt
            X509v3 Subject Key Identifier:
                BC:62:60:27:D5:E3:35:48:17:E9:4B:AB:45:6A:D0:C8:A8:77:71:8C
            X509v3 Authority Key Identifier:
                14:F6:E5:8B:31:B6:45:80:4A:4C:6D:FC:C2:87:89:CA:36:C3:90:62
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1B930549AB8CD950A55C04D383C59E3E27908492332DF945BD0EEA6AF61EE48F
    SPKI SHA256: 69BAF003CD972FE730461C1CD4B5904CA415EEB24ECE60372E5936FE1BB3CCF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootg2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootg2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootg2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Virginia Tech Global Qualified Server CA

- Subject: countryName=US, stateOrProvinceName=Virginia, localityName=Blacksburg, organizationalUnitName=Global Qualified Server CA, organizationName=Virginia Polytechnic Institute and State University, commonName=Virginia Tech Global Qualified Server CA
- Issuer: countryName=BE, organizationalUnitName=Trusted Root, organizationName=GlobalSign nv-sa, commonName=Trusted Root CA SHA256 G2
- Serial: 01E707CDC68F11E16FBBB5F84D
- SHA-256: D4D03141ECA4190D93BCEE4781AF6F2FDF0F6534A11BEDCCF0614F4D4B175753
- SPKI SHA-256: 69BAF003CD972FE730461C1CD4B5904CA415EEB24ECE60372E5936FE1BB3CCF9
- Validity: 2017-12-06 to 2022-12-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- CRL DP: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:vt.edu"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e7:07:cd:c6:8f:11:e1:6f:bb:b5:f8:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, OU = Trusted Root, O = GlobalSign nv-sa, CN = Trusted Root CA SHA256 G2
        Validity
            Not Before: Dec  6 00:00:00 2017 GMT
            Not After : Dec  6 00:00:00 2022 GMT
        Subject: C = US, ST = Virginia, L = Blacksburg, OU = Global Qualified Server CA, O = Virginia Polytechnic Institute and State University, CN = Virginia Tech Global Qualified Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BC:62:60:27:D5:E3:35:48:17:E9:4B:AB:45:6A:D0:C8:A8:77:71:8C
            X509v3 Authority Key Identifier:
                C8:63:9B:08:69:54:C2:98:C8:D9:CD:E3:33:B7:50:5E:F8:C9:01:9B
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/trustrootsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/trustrootsha2g2.crt
            X509v3 Name Constraints:
                Permitted:
                  email:vt.edu
                  DNS:bev.net
                  DNS:vcom.edu
                  DNS:vt.edu
                  DNS:vtcgit.com
                  DirName:C = US, ST = Virginia, L = Blacksburg, O = Virginia Polytechnic Institute and State University
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/trustrootsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D4D03141ECA4190D93BCEE4781AF6F2FDF0F6534A11BEDCCF0614F4D4B175753
    SPKI SHA256: 69BAF003CD972FE730461C1CD4B5904CA415EEB24ECE60372E5936FE1BB3CCF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: http://ocsp2.globalsign.com/trustrootsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/trustrootsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gs/trustrootsha2g2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":["email:vt.edu"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Virginia Tech Global Root CA

- Subject: countryName=US, organizationName=Virginia Tech, organizationalUnitName=Global Root CA, commonName=Virginia Tech Global Root CA
- Issuer: commonName=GlobalSign RootSign Partners CA, organizationalUnitName=RootSign Partners CA, organizationName=GlobalSign nv-sa, countryName=BE
- Serial: 0400000000012C5E7F1D76
- SHA-256: 12E4078670F5EB9EE686185CBEF76D0E8895D532D6D49FE211F87C048876BF86
- SPKI SHA-256: 192A80051E840CC1CDCFA4AD1999548A67120E87AC211C3514BC311F30169453
- Validity: 2010-11-18 to 2020-11-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2c:5e:7f:1d:76
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN = GlobalSign RootSign Partners CA, OU = RootSign Partners CA, O = GlobalSign nv-sa, C = BE
        Validity
            Not Before: Nov 18 10:00:00 2010 GMT
            Not After : Nov 18 10:00:00 2020 GMT
        Subject: C = US, O = Virginia Tech, OU = Global Root CA, CN = Virginia Tech Global Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                78:C3:ED:45:FE:99:0C:A2:E9:57:AE:58:52:59:2F:F2:AF:C4:C0:62
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.60
                  CPS: http://www.globalsign.com/repository/
                  User Notice:
                    Explicit Text: http://www.pki.vt.edu/rootca/cps/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/RootSignPartners.crl
            Authority Information Access:
                CA Issuers - URI:http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
            X509v3 Authority Key Identifier:
                56:84:EC:B5:71:A5:E7:63:D8:DB:51:04:D6:FA:E6:F0:48:52:49:CE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 12E4078670F5EB9EE686185CBEF76D0E8895D532D6D49FE211F87C048876BF86
    SPKI SHA256: 192A80051E840CC1CDCFA4AD1999548A67120E87AC211C3514BC311F30169453
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4146.1.60
- AIA OCSP: -
- AIA CA Issuers: http://secure.globalsign.net/cacert/RootSignPartners-R1.crt
- CRL Distribution Points: http://crl.globalsign.net/RootSignPartners.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### VTB BANK GCC R6 DV CA 2021

- Subject: countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 DV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE92CB8CB6B98CE748BB108E7D26
- SHA-256: 95BA96F72CB314ECD05CE0FD75D886381A368C8F5869F04BDD3024893F4E393B
- SPKI SHA-256: A259DE7BCB7CC4EB1858635290871850261E35E9F28711BA47F94B45ADB2308D
- Validity: 2021-04-21 to 2031-04-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/vtbbankgccr6dvca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:92:cb:8c:b6:b9:8c:e7:48:bb:10:8e:7d:26
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2031 GMT
        Subject: C = RU, O = VTB BANK (PJSC), CN = VTB BANK GCC R6 DV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E3:E5:BF:6F:C0:E5:A3:91:28:5B:94:4E:1E:D6:D6:25:CF:B5:72:9D
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.4146.10.1.3
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 95BA96F72CB314ECD05CE0FD75D886381A368C8F5869F04BDD3024893F4E393B
    SPKI SHA256: A259DE7BCB7CC4EB1858635290871850261E35E9F28711BA47F94B45ADB2308D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.4146.10.1.3
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VTB BANK GCC R6 EV CA 2021

- Subject: countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 EV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE9729D2035FDB91F317CF5F7B21
- SHA-256: 52C09A2CA179368703A1857004CD5A3C87D3BDAC3A558E143EF3508FBEEB1032
- SPKI SHA-256: 5C56DA8F62BB497FFC2DB6FF379A3CCFE0F00838982B273666C4580856307806
- Validity: 2021-04-21 to 2031-04-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/vtbbankgccr6evca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:97:29:d2:03:5f:db:91:f3:17:cf:5f:7b:21
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2031 GMT
        Subject: C = RU, O = VTB BANK (PJSC), CN = VTB BANK GCC R6 EV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                41:2B:12:5C:CB:1B:A6:96:E9:02:31:1D:0E:9B:DA:E3:33:56:C1:9F
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.4146.10.1.1
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 52C09A2CA179368703A1857004CD5A3C87D3BDAC3A558E143EF3508FBEEB1032
    SPKI SHA256: 5C56DA8F62BB497FFC2DB6FF379A3CCFE0F00838982B273666C4580856307806
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.4146.10.1.1
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VTB BANK GCC R6 OV CA 2021

- Subject: countryName=RU, organizationName=VTB BANK (PJSC), commonName=VTB BANK GCC R6 OV CA 2021
- Issuer: organizationalUnitName=GlobalSign Root CA - R6, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 79B9FE93CF7282AA5E5C569D8E2AC8E1
- SHA-256: 312AB012744F859EEF8AE0FA25D0259E89DAAF51B94FAC67DFC61060F0DB2207
- SPKI SHA-256: D4D0CCAEF3E01088157FF4F4C7515BA6F01FB10437DB166749812A790EA7CC3E
- Validity: 2021-04-21 to 2031-04-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.globalsign.com/vtbbankgccr6ovca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- CRL DP: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b9:fe:93:cf:72:82:aa:5e:5c:56:9d:8e:2a:c8:e1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R6, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 21 00:00:00 2021 GMT
            Not After : Apr 21 00:00:00 2031 GMT
        Subject: C = RU, O = VTB BANK (PJSC), CN = VTB BANK GCC R6 OV CA 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                64:BA:B2:F9:5E:8A:AA:84:ED:3F:7B:CE:35:9A:67:37:0C:B8:16:75
            X509v3 Authority Key Identifier:
                AE:6C:05:A3:93:13:E2:A2:E7:E2:D7:1C:D6:C7:F0:7F:C8:67:53:A0
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr6
                CA Issuers - URI:http://secure.globalsign.com/cacert/root-r6.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r6.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.4146.10.1.2
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 312AB012744F859EEF8AE0FA25D0259E89DAAF51B94FAC67DFC61060F0DB2207
    SPKI SHA256: D4D0CCAEF3E01088157FF4F4C7515BA6F01FB10437DB166749812A790EA7CC3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.4146.10.1.2
- AIA OCSP: http://ocsp2.globalsign.com/rootr6
- AIA CA Issuers: http://secure.globalsign.com/cacert/root-r6.crt
- CRL Distribution Points: http://crl.globalsign.com/root-r6.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VWFS CA for AATL

- Subject: countryName=GB, organizationName=Volkswagen Financial Services (UK) Limited, commonName=VWFS CA for AATL
- Issuer: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign CA for AATL - SHA256 - G2
- Serial: 01E12352086E1FB1F477B34C9C
- SHA-256: CF89A41DFEE5F71740DEF602735DDBF1DEBE0CB816D73980D9A583C5881CE778
- SPKI SHA-256: 440067B17D6C05DB8C2427452741FD54DDEB79CC9D3889E75F8A88AD1FF97860
- Validity: 2017-04-19 to 2022-04-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- CRL DP: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.vwfs.co.uk","email:vwfs.co.uk"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e1:23:52:08:6e:1f:b1:f4:77:b3:4c:9c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign CA for AATL - SHA256 - G2
        Validity
            Not Before: Apr 19 00:00:00 2017 GMT
            Not After : Apr 19 00:00:00 2022 GMT
        Subject: C = GB, O = Volkswagen Financial Services (UK) Limited, CN = VWFS CA for AATL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                OCSP Signing, 1.3.6.1.4.1.311.10.3.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                85:88:43:B4:7D:34:84:6F:C5:17:2D:B9:06:1E:56:20:70:D7:E8:13
            X509v3 Authority Key Identifier:
                60:C2:F1:52:3E:AD:8C:13:DC:DB:CA:0E:FA:0A:E6:2A:2C:99:4B:D8
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/gsaatlsha2g2
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
            X509v3 Name Constraints: critical
                Permitted:
                  email:.vwfs.co.uk
                  email:vwfs.co.uk
                  DNS:vwfs.co.uk
                  DirName:C = GB, O = Volkswagen Financial Services (UK) Limited
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gsaatlsha2g2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.40.30
                Policy: 1.3.6.1.4.1.4146.1.95
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF89A41DFEE5F71740DEF602735DDBF1DEBE0CB816D73980D9A583C5881CE778
    SPKI SHA256: 440067B17D6C05DB8C2427452741FD54DDEB79CC9D3889E75F8A88AD1FF97860
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: OCSP Signing, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.4146.1.40.30, 1.3.6.1.4.1.4146.1.95
- AIA OCSP: http://ocsp2.globalsign.com/gsaatlsha2g2
- AIA CA Issuers: http://secure.globalsign.com/cacert/gsaatlsha2g2.crt
- CRL Distribution Points: http://crl.globalsign.com/gsaatlsha2g2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:.vwfs.co.uk","email:vwfs.co.uk"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired
