# CA Owner Audit Dump - Google Trust Services LLC

Generated: 2026-07-28T05:57:12.226073Z

## CA Owner Summary

- Name: Google Trust Services LLC
- Country: United States of America
- Website: -
- Problem Reporting: https://pki.goog/
- CP/CPS URLs: https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.6/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.4/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.3/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.1/GTS-CP-CPS-SMIME.html, https://downloads.globalsign.com/acton/attachment/2674/f-05c8fa55-d3bb-40ae-833e-81a6dfc7dfea/1/-/-/-/-/GlobalSign_CA_CP_v6.1_RELEASED.pdf, https://downloads.globalsign.com/acton/attachment/2674/f-2075e06c-b313-4277-8d17-3ab4b03f70e3/1/-/-/-/-/GlobalSign_CA_CPS_v9.1_RELEASED.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=51ff0831-ae52-4b41-b3f7-a259074b61d2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=86d06a15-4344-49f6-8f50-eefcbaf44af4, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f65aab9e-bd06-4a48-ab8f-32428948a28a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=161fd394-1df2-40a2-a044-aee209fb853a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231566, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231567, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231568
- Root Programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Disabled","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://pki.goog/
- CP/CPS URLs: https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html, https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.6/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.4/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.3/GTS-CP-CPS-SMIME.html, https://pki.goog/repo/cp-cps-smime/6.1/GTS-CP-CPS-SMIME.html, https://downloads.globalsign.com/acton/attachment/2674/f-05c8fa55-d3bb-40ae-833e-81a6dfc7dfea/1/-/-/-/-/GlobalSign_CA_CP_v6.1_RELEASED.pdf, https://downloads.globalsign.com/acton/attachment/2674/f-2075e06c-b313-4277-8d17-3ab4b03f70e3/1/-/-/-/-/GlobalSign_CA_CPS_v9.1_RELEASED.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=51ff0831-ae52-4b41-b3f7-a259074b61d2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=86d06a15-4344-49f6-8f50-eefcbaf44af4, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f65aab9e-bd06-4a48-ab8f-32428948a28a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=161fd394-1df2-40a2-a044-aee209fb853a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231566, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231567, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231568
- Repository URLs: https://pki.goog/repository, https://www.globalsign.com/en/repository/
- Root programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Disabled","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign | yes | expired | 2006-12-15 to 2021-12-15 | - | - | - | clean |
| 2 | organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign | yes | unknown | 2012-11-13 to 2038-01-19 | - | - | - | current errors: 1 |
| 3 | organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign | yes | unknown | 2012-11-13 to 2038-01-19 | - | - | - | current errors: 1 |
| 4 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 5 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 6 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 7 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 8 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 9 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 10 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 11 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4 | yes | unknown | 2016-06-22 to 2036-06-22 | - | - | - | clean |
| 12 | countryName=US, organizationName=Google Trust Services, commonName=AE1 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 13 | countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4 | yes | revoked, expired | 2018-11-01 to 2021-12-15 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 14 | countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4 ECC | yes | revoked | 2018-11-01 to 2028-11-01 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 15 | countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4x | yes | revoked, expired | 2020-08-13 to 2023-09-30 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 16 | organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign | yes | expired | 2006-12-15 to 2021-12-15 | - | - | - | clean |
| 17 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign EC Administration CA1 | yes | revoked, expired | 2012-11-13 to 2023-11-13 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 18 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC256 EV SSL CA - G3 | yes | revoked, expired | 2015-04-30 to 2025-04-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 19 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC256 SSL CA - G3 | yes | revoked, expired | 2015-04-30 to 2025-04-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 20 | organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA | yes | revoked, expired | 2009-06-23 to 2021-12-15 | 2.5.29.32.0 | 0 | - | clean |
| 21 | organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA | yes | revoked, expired | 2009-06-23 to 2021-12-15 | 2.5.29.32.0 | 0 | Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 22 | organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA | yes | revoked, expired | 2007-01-10 to 2021-12-15 | 2.5.29.32.0 | 0 | - | clean |
| 23 | organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA | yes | revoked, expired | 2007-05-04 to 2021-12-15 | 2.5.29.32.0 | 0 | Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 24 | organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA | yes | revoked, expired | 2007-05-04 to 2021-12-15 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto | clean |
| 25 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | - | clean |
| 26 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - G2 | yes | revoked, expired | 2011-04-13 to 2022-04-13 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto | clean |
| 27 | countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G2 | yes | revoked, expired | 2014-02-20 to 2021-12-15 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 28 | countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA | yes | revoked, expired | 2014-02-20 to 2021-12-15 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 29 | countryName=US, organizationName=Google Trust Services, commonName=Google Internet Authority G3 | yes | revoked, expired | 2017-06-15 to 2021-12-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 30 | countryName=US, organizationName=Google Inc, commonName=Google Internet Authority G3 | yes | revoked, expired | 2017-02-25 to 2021-12-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 31 | countryName=US, organizationName=Google Trust Services, commonName=Google Internet Authority G3 ECC | yes | revoked | 2017-06-15 to 2027-06-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 32 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1C3 | yes | revoked | 2020-08-13 to 2027-09-30 | 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 33 | countryName=US, organizationName=Google Trust Services, commonName=GTS CA 1D2 | yes | expired | 2017-06-15 to 2021-12-15 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 34 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D4 | yes | revoked | 2020-08-13 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 35 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D8 | yes | revoked | 2022-10-05 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 36 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D9 | yes | revoked | 2023-08-24 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 37 | countryName=US, organizationName=Google Trust Services, commonName=GTS CA 1O1 | yes | expired | 2017-06-15 to 2021-12-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 38 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1P5 | yes | revoked | 2020-08-13 to 2027-09-30 | 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 39 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2A1 | yes | revoked, expired | 2020-08-13 to 2025-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3.1 | 0 | TLS Web Server Authentication | clean |
| 40 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D3 | yes | revoked | 2022-10-05 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 41 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D4 | yes | revoked | 2022-10-05 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 42 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D5 | yes | revoked | 2023-08-24 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 43 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D6 | yes | revoked | 2023-08-24 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 44 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2P2 | yes | revoked | 2022-10-05 to 2027-09-30 | 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 45 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X1 | yes | revoked, expired | 2016-06-22 to 2026-06-22 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 46 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X2 | yes | revoked, expired | 2016-06-22 to 2026-06-22 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 47 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X3 | yes | revoked, expired | 2016-06-22 to 2026-06-22 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 48 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X4 | yes | revoked, expired | 2016-06-22 to 2026-06-22 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 49 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y1 | yes | revoked | 2018-11-01 to 2028-11-01 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 50 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y2 | yes | revoked | 2018-11-01 to 2028-11-01 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 51 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y3 | yes | revoked | 2018-11-01 to 2028-11-01 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 52 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y3 | yes | revoked | 2020-01-30 to 2030-01-30 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 53 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y4 | yes | revoked | 2018-11-01 to 2028-11-01 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 54 | countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y4 | yes | revoked | 2020-01-30 to 2030-01-30 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 55 | countryName=US, organizationName=Google Trust Services, commonName=MR1 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.5.1.3 | 0 | E-mail Protection | current errors: 1 |
| 56 | countryName=US, organizationName=Google Trust Services, commonName=WE1 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 57 | countryName=US, organizationName=Google Trust Services, commonName=WE1 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 58 | countryName=US, organizationName=Google Trust Services, commonName=WE2 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 59 | countryName=US, organizationName=Google Trust Services, commonName=WE2 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 60 | countryName=US, organizationName=Google Trust Services, commonName=WE3 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 61 | countryName=US, organizationName=Google Trust Services, commonName=WE3 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 62 | countryName=US, organizationName=Google Trust Services, commonName=WE4 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 63 | countryName=US, organizationName=Google Trust Services, commonName=WE4 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 64 | countryName=US, organizationName=Google Trust Services, commonName=WE5 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 65 | countryName=US, organizationName=Google Trust Services, commonName=WR1 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 66 | countryName=US, organizationName=Google Trust Services, commonName=WR2 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 67 | countryName=US, organizationName=Google Trust Services, commonName=WR3 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 68 | countryName=US, organizationName=Google Trust Services, commonName=WR4 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 69 | countryName=US, organizationName=Google Trust Services, commonName=WR5 | yes | current | 2023-12-13 to 2029-02-20 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |

## Certificate Details

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000010F8626E60D
- SHA-256: CA42DD41745FD0B81EB902362CF9D8BF719DA1BD1B1EFC946F5B4C99F42C1B9E
- SPKI SHA-256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
- Validity: 2006-12-15 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=51ff0831-ae52-4b41-b3f7-a259074b61d2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=86d06a15-4344-49f6-8f50-eefcbaf44af4, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f65aab9e-bd06-4a48-ab8f-32428948a28a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=161fd394-1df2-40a2-a044-aee209fb853a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:0f:86:26:e6:0d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 15 08:00:00 2006 GMT
            Not After : Dec 15 08:00:00 2021 GMT
        Subject: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CA42DD41745FD0B81EB902362CF9D8BF719DA1BD1B1EFC946F5B4C99F42C1B9E
    SPKI SHA256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign

- Subject: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 2A38A41C960A04DE42B228A50BE8349802
- SHA-256: BEC94911C2955676DB6C0A550986D76E3BA005667C442C9762B4FBB773DE228C
- SPKI SHA-256: 08B3A6335FCE5EF48F8F0E543986C07FD18A3B1226129F61864BBD5BDD1F1CC9
- Validity: 2012-11-13 to 2038-01-19
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/root-r4.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2a:38:a4:1c:96:0a:04:de:42:b2:28:a5:0b:e8:34:98:02
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: BEC94911C2955676DB6C0A550986D76E3BA005667C442C9762B4FBB773DE228C
    SPKI SHA256: 08B3A6335FCE5EF48F8F0E543986C07FD18A3B1226129F61864BBD5BDD1F1CC9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GlobalSign

- Subject: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0203E57EF53F93FDA50921B2A6
- SHA-256: B085D70B964F191A73E4AF0D54AE7A0E07AAFDAF9B71DD0862138AB7325A24A2
- SPKI SHA-256: 08B3A6335FCE5EF48F8F0E543986C07FD18A3B1226129F61864BBD5BDD1F1CC9
- Validity: 2012-11-13 to 2038-01-19
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/r/gsr4.crl, http://crl.pki.goog/gsr4/gsr4.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e5:7e:f5:3f:93:fd:a5:09:21:b2:a6
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 13 00:00:00 2012 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: B085D70B964F191A73E4AF0D54AE7A0E07AAFDAF9B71DD0862138AB7325A24A2
    SPKI SHA256: 08B3A6335FCE5EF48F8F0E543986C07FD18A3B1226129F61864BBD5BDD1F1CC9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_country_name_missing: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 0203E5936F31B01349886BA217
- SHA-256: D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF
- SPKI SHA-256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
- Validity: 2016-06-22 to 2036-06-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr1/gtsr1.crl, http://c.pki.goog/r/r1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e5:93:6f:31:b0:13:49:88:6b:a2:17
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D947432ABDE7B7FA90FC2E6B59101B1280E0E1C7E4E40FA3C6887FFF57A7F4CF
    SPKI SHA256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 6E47A9C54B470C0DEC33D089B91CF4E1
- SHA-256: 2A575471E31340BC21581CBD2CF13E158463203ECE94BCF9D3CC196BF09A5472
- SPKI SHA-256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
- Validity: 2016-06-22 to 2036-06-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr1/gtsr1.crl, http://c.pki.goog/r/r1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:c5:4b:47:0c:0d:ec:33:d0:89:b9:1c:f4:e1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2A575471E31340BC21581CBD2CF13E158463203ECE94BCF9D3CC196BF09A5472
    SPKI SHA256: 871A9194F4EED5B312FF40C84C1D524AED2F778BBFF25F138CF81F680A7ADC67
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R2

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 0203E5AEC58D04251AAB1125AA
- SHA-256: 8D25CD97229DBF70356BDA4EB3CC734031E24CF00FAFCFD32DC76EB5841C7EA8
- SPKI SHA-256: 55F77DE41C03792428F8D518C55104225BE43A5598D926A528AD653E1CCEC7BF
- Validity: 2016-06-22 to 2036-06-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-smime/6.6/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.4/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.3/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-smime/6.1/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr2/gtsr2.crl, http://c.pki.goog/r/r2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e5:ae:c5:8d:04:25:1a:ab:11:25:aa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8D25CD97229DBF70356BDA4EB3CC734031E24CF00FAFCFD32DC76EB5841C7EA8
    SPKI SHA256: 55F77DE41C03792428F8D518C55104225BE43A5598D926A528AD653E1CCEC7BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R2

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 6E47A9C65AB3E720C5309A3F6852F26F
- SHA-256: C45D7BB08E6D67E62E4235110B564E5F78FD92EF058C840AEA4E6455D7585C60
- SPKI SHA-256: 55F77DE41C03792428F8D518C55104225BE43A5598D926A528AD653E1CCEC7BF
- Validity: 2016-06-22 to 2036-06-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-smime/6.6/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.4/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.3/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-smime/6.1/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr2/gtsr2.crl, http://c.pki.goog/r/r2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:c6:5a:b3:e7:20:c5:30:9a:3f:68:52:f2:6f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C45D7BB08E6D67E62E4235110B564E5F78FD92EF058C840AEA4E6455D7585C60
    SPKI SHA256: 55F77DE41C03792428F8D518C55104225BE43A5598D926A528AD653E1CCEC7BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 0203E5B882EB20F825276D3D66
- SHA-256: 34D8A73EE208D9BCDB0D956520934B4E40E69482596E8B6F73C8426B010A6F48
- SPKI SHA-256: 4179EDD981EF747477B49626408AF43DAA2CA7AB7F9E082C1060F84096774348
- Validity: 2016-06-22 to 2036-06-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr3/gtsr3.crl, http://c.pki.goog/r/r3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e5:b8:82:eb:20:f8:25:27:6d:3d:66
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 34D8A73EE208D9BCDB0D956520934B4E40E69482596E8B6F73C8426B010A6F48
    SPKI SHA256: 4179EDD981EF747477B49626408AF43DAA2CA7AB7F9E082C1060F84096774348
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 6E47A9C76CA9732440890F0355DD8D1D
- SHA-256: 15D5B8774619EA7D54CE1CA6D0B0C403E037A917F131E8A04E1E6B7A71BABCE5
- SPKI SHA-256: 4179EDD981EF747477B49626408AF43DAA2CA7AB7F9E082C1060F84096774348
- Validity: 2016-06-22 to 2036-06-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr3/gtsr3.crl, http://c.pki.goog/r/r3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:c7:6c:a9:73:24:40:89:0f:03:55:dd:8d:1d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 15D5B8774619EA7D54CE1CA6D0B0C403E037A917F131E8A04E1E6B7A71BABCE5
    SPKI SHA256: 4179EDD981EF747477B49626408AF43DAA2CA7AB7F9E082C1060F84096774348
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 6E47A9C88B94B6E8BB3B2AD8A2B2C199
- SHA-256: 71CCA5391F9E794B04802530B363E121DA8A3043BB26662FEA4DCA7FC951A4BD
- SPKI SHA-256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
- Validity: 2016-06-22 to 2036-06-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr4/gtsr4.crl, http://c.pki.goog/r/r4.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:c8:8b:94:b6:e8:bb:3b:2a:d8:a2:b2:c1:99
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 71CCA5391F9E794B04802530B363E121DA8A3043BB26662FEA4DCA7FC951A4BD
    SPKI SHA256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### GTS Root R4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 0203E5C068EF631A9C72905052
- SHA-256: 349DFA4058C5E263123B398AE795573C4E1313C83FE68F93556CD5E8031B3C7D
- SPKI SHA-256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
- Validity: 2016-06-22 to 2036-06-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.goog/repo/cp-cps-tls/6.6/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.5/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.5/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.4/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.3/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-tls/6.1/GTS-CP-CPS-TLS.html; https://pki.goog/repo/cp-cps-smime/6.2/GTS-CP-CPS-SMIME.html; https://pki.goog/repo/cp-cps-tls/6.0/GTS-CP-CPS-TLS.html
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d439f62-5004-417d-a604-5449422449f2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f344b54-25d0-4f70-abb8-df17cba953f7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c3086bc5-d09f-4071-b9d5-b9fc8b478d77, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7e98da1f-8c59-47b0-b201-d2d3fa7548a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/gtsr4/gtsr4.crl, http://c.pki.goog/r/r4.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e5:c0:68:ef:63:1a:9c:72:90:50:52
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2036 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 349DFA4058C5E263123B398AE795573C4E1313C83FE68F93556CD5E8031B3C7D
    SPKI SHA256: 9847E5653E5E9E847516E5CB818606AA7544A19BE67FD7366D506988E8D84347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### AE1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=AE1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 7FF4E5CE36A6A1FA5EE1916C08D39B7C
- SHA-256: 812C212E9E45DC5005C7F47411183F5FB2FF1BAEE184D3354B2E93D78C280164
- SPKI SHA-256: 2069D07883E36F1891F89B5E47B02451797BA55FB5F414F8C77A35E6C69904D1
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/ae1/6Qkl-YOr2gw.crl, http://c.pki.goog/ae1/Lvix_2k-xAo.crl, http://c.pki.goog/ae1/Q_ixz1v4X94.crl, http://c.pki.goog/ae1/gNiJ3W0raSk.crl, http://c.pki.goog/ae1/tUBG9DWP43g.crl, http://c.pki.goog/ae1/tUmIKqKoZ_0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f4:e5:ce:36:a6:a1:fa:5e:e1:91:6c:08:d3:9b:7c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = AE1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                48:89:60:F9:A3:7D:0C:EA:00:24:A2:DC:9F:07:CE:46:88:A8:32:3A
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 812C212E9E45DC5005C7F47411183F5FB2FF1BAEE184D3354B2E93D78C280164
    SPKI SHA256: 2069D07883E36F1891F89B5E47B02451797BA55FB5F414F8C77A35E6C69904D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r4.crt
- CRL Distribution Points: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### GIAG4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01F09C5754579760872C7C2473
- SHA-256: 178CE2CE41E6D29926C89372ECF01B1120AD7B6D980AD298354C2EFD3141E129
- SPKI SHA-256: 0001A8968D0DD6265AE6EBAF9B4D9CB199E4B99B3C86F23E1D12E1007B4D86A9
- Validity: 2018-11-01 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gsr2
- CRL DP: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:9c:57:54:57:97:60:87:2c:7c:24:73
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Dec 15 00:00:42 2021 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GIAG4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:0A:93:CE:D9:D4:F7:9A:A9:97:44:50:35:66:D8:CD:7D:6F:5A:10
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr2
                CA Issuers - URI:http://pki.goog/gsr2/gsr2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr2/gsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 178CE2CE41E6D29926C89372ECF01B1120AD7B6D980AD298354C2EFD3141E129
    SPKI SHA256: 0001A8968D0DD6265AE6EBAF9B4D9CB199E4B99B3C86F23E1D12E1007B4D86A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr2
- AIA CA Issuers: http://pki.goog/gsr2/gsr2.crt
- CRL Distribution Points: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GIAG4 ECC

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4 ECC
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01F09C578AE0E9FC1855867C64
- SHA-256: CAF3A229D454597F262939F07E105683A71FDCF91646FC60A32AF6B354FE52AE
- SPKI SHA-256: 05973FE57144AF888D1F1AAFF49DF483CF7A9F98D3E4824B6192675F2A949085
- Validity: 2018-11-01 to 2028-11-01
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GIAG4ECC.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gsr4
- CRL DP: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:9c:57:8a:e0:e9:fc:18:55:86:7c:64
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Nov  1 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GIAG4 ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                80:8C:FC:16:0A:C8:F3:99:CE:5C:93:BF:63:E3:4A:96:CB:9C:99:B4
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr4
                CA Issuers - URI:http://pki.goog/gsr4/gsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr4/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: CAF3A229D454597F262939F07E105683A71FDCF91646FC60A32AF6B354FE52AE
    SPKI SHA256: 05973FE57144AF888D1F1AAFF49DF483CF7A9F98D3E4824B6192675F2A949085
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr4
- AIA CA Issuers: http://pki.goog/gsr4/gsr4.crt
- CRL Distribution Points: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GIAG4x

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GIAG4x
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 0203F3588816160E0A4527F2A5
- SHA-256: D3680B4E3F88DB1F5BB9DDDBFB6BFF319C780E3D9F44EE24EC1995AB42D6914F
- SPKI SHA-256: 0001A8968D0DD6265AE6EBAF9B4D9CB199E4B99B3C86F23E1D12E1007B4D86A9
- Validity: 2020-08-13 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GIAG4x.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:f3:58:88:16:16:0e:0a:45:27:f2:a5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Aug 13 00:00:42 2020 GMT
            Not After : Sep 30 00:00:42 2023 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GIAG4x
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:0A:93:CE:D9:D4:F7:9A:A9:97:44:50:35:66:D8:CD:7D:6F:5A:10
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr1.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D3680B4E3F88DB1F5BB9DDDBFB6BFF319C780E3D9F44EE24EC1995AB42D6914F
    SPKI SHA256: 0001A8968D0DD6265AE6EBAF9B4D9CB199E4B99B3C86F23E1D12E1007B4D86A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr1.der
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GlobalSign

- Subject: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0203E4F461EC99D9D57966CA7A
- SHA-256: 69E2D06C30F366166165E91D68D1CEE5CC47584A80227E76666086C0107241EB
- SPKI SHA-256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
- Validity: 2006-12-15 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:e4:f4:61:ec:99:d9:d5:79:66:ca:7a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 15 08:00:00 2006 GMT
            Not After : Dec 15 08:00:00 2021 GMT
        Subject: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 69E2D06C30F366166165E91D68D1CEE5CC47584A80227E76666086C0107241EB
    SPKI SHA256: 8A27B5557B4BEC7CC0305FBF3D53D1F71CD3F34910C5D65E27ECDDB82077BA3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### GlobalSign EC Administration CA1

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign EC Administration CA1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 1F07B1827FD908989C64F72C23223CCF14
- SHA-256: D407E09511429E170140E147E69AC5587BE99A4939C8DDECE1D81478F900F58D
- SPKI SHA-256: ECD04E4566E9E43AA7823803CB4789212C4381A4420C4C5A1E9665D6EBC6243D
- Validity: 2012-11-13 to 2023-11-13
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- CRL DP: http://crl.globalsign.com/gs/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:07:b1:82:7f:d9:08:98:9c:64:f7:2c:23:22:3c:cf:14
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Nov 13 01:00:00 2012 GMT
            Not After : Nov 13 01:00:00 2023 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign EC Administration CA1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/gs/root-r4.crl
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr4
            X509v3 Subject Key Identifier:
                BD:D4:38:3F:19:22:7E:18:D5:9C:F3:5E:07:DA:55:26:BE:DD:CC:72
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: D407E09511429E170140E147E69AC5587BE99A4939C8DDECE1D81478F900F58D
    SPKI SHA256: ECD04E4566E9E43AA7823803CB4789212C4381A4420C4C5A1E9665D6EBC6243D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/gs/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign ECC256 EV SSL CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC256 EV SSL CA - G3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 467437760E4A74366CD27C85664E
- SHA-256: CFAE85A51DB2D62F1CDAE16F5D43329F759883CEC957A28A8126AC7E613E2129
- SPKI SHA-256: 3FD3276A8F1C53AB5D37F5AD382D46CC7FDDB9207347A97A3A24EE41AF7CD47B
- Validity: 2015-04-30 to 2025-04-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- CRL DP: http://crl.globalsign.com/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:76:0e:4a:74:36:6c:d2:7c:85:66:4e
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC256 EV SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CF:A4:B4:A6:60:31:63:FE:DD:4E:F0:93:86:01:CB:00:7D:26:17:4B
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: CFAE85A51DB2D62F1CDAE16F5D43329F759883CEC957A28A8126AC7E613E2129
    SPKI SHA256: 3FD3276A8F1C53AB5D37F5AD382D46CC7FDDB9207347A97A3A24EE41AF7CD47B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign ECC256 SSL CA - G3

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign ECC256 SSL CA - G3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 467437758A2FC2F0740F9AB66066
- SHA-256: 0E69E4AB749144816A8502C44998AACBF125485EA1FEE77F7006ACA400E55B2D
- SPKI SHA-256: 071C8E0DF9A8396C47F58BF1684C4CF253D95F7A3681022882B647AB31D0E6DE
- Validity: 2015-04-30 to 2025-04-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- CRL DP: http://crl.globalsign.com/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:74:37:75:8a:2f:c2:f0:74:0f:9a:b6:60:66
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 30 00:00:00 2015 GMT
            Not After : Apr 30 00:00:00 2025 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign ECC256 SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:EF:88:96:B0:1B:A2:92:20:33:70:6E:4E:28:3B:0F:49:9A:1D:B7
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp2.globalsign.com/rootr4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.com/root-r4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 0E69E4AB749144816A8502C44998AACBF125485EA1FEE77F7006ACA400E55B2D
    SPKI SHA256: 071C8E0DF9A8396C47F58BF1684C4CF253D95F7A3681022882B647AB31D0E6DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp2.globalsign.com/rootr4
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.com/root-r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA

- Subject: organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001220D3C0F75
- SHA-256: 8E7BB140C3DC451371A0C82112426392E3B39C08A793F85541E33C4F840FA4C8
- SPKI SHA-256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
- Validity: 2009-06-23 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:22:0d:3c:0f:75
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 23 12:00:00 2009 GMT
            Not After : Dec 15 07:00:00 2021 GMT
        Subject: OU = Extended Validation CA, O = GlobalSign, CN = GlobalSign Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                34:B1:F9:C9:8C:6B:35:44:CC:08:69:0A:EE:E3:A3:B9:5C:BF:16:E0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLCA
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8E7BB140C3DC451371A0C82112426392E3B39C08A793F85541E33C4F840FA4C8
    SPKI SHA256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA

- Subject: organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001220D3C14C5
- SHA-256: 88268050FCFE204E307E5422183AFFCA21F83A51A397B2D886B47635D40155CA
- SPKI SHA-256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
- Validity: 2009-06-23 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:22:0d:3c:14:c5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 23 12:00:00 2009 GMT
            Not After : Dec 15 07:00:00 2021 GMT
        Subject: OU = Extended Validation CA, O = GlobalSign, CN = GlobalSign Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                34:B1:F9:C9:8C:6B:35:44:CC:08:69:0A:EE:E3:A3:B9:5C:BF:16:E0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLCA
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 88268050FCFE204E307E5422183AFFCA21F83A51A397B2D886B47635D40155CA
    SPKI SHA256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA

- Subject: organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001100B8CA11B
- SHA-256: F09EA679887E91A0F9597A61A0C8E60E14E3E73A050FEAFEDCB48FDC4A1D5100
- SPKI SHA-256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
- Validity: 2007-01-10 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:10:0b:8c:a1:1b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jan 10 10:00:00 2007 GMT
            Not After : Dec 15 07:00:00 2021 GMT
        Subject: OU = Extended Validation CA, O = GlobalSign, CN = GlobalSign Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                34:B1:F9:C9:8C:6B:35:44:CC:08:69:0A:EE:E3:A3:B9:5C:BF:16:E0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F09EA679887E91A0F9597A61A0C8E60E14E3E73A050FEAFEDCB48FDC4A1D5100
    SPKI SHA256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Extended Validation CA

- Subject: organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000011256AD5FB2
- SHA-256: F9D1B330843EEF956C46E29A0D692FBA6F53CA89532AA7E2637EE792D2AFD861
- SPKI SHA-256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
- Validity: 2007-05-04 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:12:56:ad:5f:b2
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May  4 10:00:00 2007 GMT
            Not After : Dec 15 07:00:00 2021 GMT
        Subject: OU = Extended Validation CA, O = GlobalSign, CN = GlobalSign Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                34:B1:F9:C9:8C:6B:35:44:CC:08:69:0A:EE:E3:A3:B9:5C:BF:16:E0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F9D1B330843EEF956C46E29A0D692FBA6F53CA89532AA7E2637EE792D2AFD861
    SPKI SHA256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GlobalSign Extended Validation CA

- Subject: organizationalUnitName=Extended Validation CA, organizationName=GlobalSign, commonName=GlobalSign Extended Validation CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 04000000000127FBF76700
- SHA-256: 8F48CF975984FF375E8F7E859B5EFDAB3284AFCB323BF2B3632379FCD75B32A7
- SPKI SHA-256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
- Validity: 2007-05-04 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:27:fb:f7:67:00
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: May  4 10:00:00 2007 GMT
            Not After : Dec 15 07:00:00 2021 GMT
        Subject: OU = Extended Validation CA, O = GlobalSign, CN = GlobalSign Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 Subject Key Identifier:
                34:B1:F9:C9:8C:6B:35:44:CC:08:69:0A:EE:E3:A3:B9:5C:BF:16:E0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLCA
            Netscape Cert Type:
                SSL CA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8F48CF975984FF375E8F7E859B5EFDAB3284AFCB323BF2B3632379FCD75B32A7
    SPKI SHA256: 871AD10966C88C1E4519166FFBEA809ACEEE5FAF6A142E39681855A5E19C95CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000012F4EE15B63
- SHA-256: 0B11A032DFFBA17D8DF46FD0D4C6DFBBF72A6221042D540A20A5668E7635FEED
- SPKI SHA-256: 486FEC06830973D22027CF9D1A0207C932EFCFBC325418A8EE53280DA9CFB919
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:5b:63
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B0:B0:4A:FD:1C:75:28:F8:1C:61:AA:13:F6:FA:C1:90:3D:6B:16:A3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLCA
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0B11A032DFFBA17D8DF46FD0D4C6DFBBF72A6221042D540A20A5668E7635FEED
    SPKI SHA256: 486FEC06830973D22027CF9D1A0207C932EFCFBC325418A8EE53280DA9CFB919
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 0400000000012F4EE15DD4
- SHA-256: 6C368F05EA9318948A60294B1FC45E7B8B3B0D765568693F0669B50CF4894056
- SPKI SHA-256: 486FEC06830973D22027CF9D1A0207C932EFCFBC325418A8EE53280DA9CFB919
- Validity: 2011-04-13 to 2022-04-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:2f:4e:e1:5d:d4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Apr 13 10:00:00 2011 GMT
            Not After : Apr 13 10:00:00 2022 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B0:B0:4A:FD:1C:75:28:F8:1C:61:AA:13:F6:FA:C1:90:3D:6B:16:A3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/ExtendedSSLCA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6C368F05EA9318948A60294B1FC45E7B8B3B0D765568693F0669B50CF4894056
    SPKI SHA256: 486FEC06830973D22027CF9D1A0207C932EFCFBC325418A8EE53280DA9CFB919
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/ExtendedSSLCA
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Extended Validation CA - SHA256 - G2

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, commonName=GlobalSign Extended Validation CA - SHA256 - G2
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001444EF04A55
- SHA-256: 24F91C0705A0A5338641B365FB0D9D9709B56297CFF1857E73C02C1636D486AA
- SPKI SHA-256: 2EF4621848D1A9FCEEADECDA5AE8FC5A27B68321CCAD6E50D3A2ECA4C9E8C7B0
- Validity: 2014-02-20 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://downloads.globalsign.com/acton/attachment/2674/f-05c8fa55-d3bb-40ae-833e-81a6dfc7dfea/1/-/-/-/-/GlobalSign_CA_CP_v6.1_RELEASED.pdf, https://downloads.globalsign.com/acton/attachment/2674/f-2075e06c-b313-4277-8d17-3ab4b03f70e3/1/-/-/-/-/GlobalSign_CA_CPS_v9.1_RELEASED.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231566, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231567, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=231568
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr2
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:4a:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Dec 15 08:00:00 2021 GMT
        Subject: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:40:77:43:65:1C:F8:FE:A7:E3:F4:64:82:3E:4D:43:13:22:31:02
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.globalsign.com/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr2
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 24F91C0705A0A5338641B365FB0D9D9709B56297CFF1857E73C02C1636D486AA
    SPKI SHA256: 2EF4621848D1A9FCEEADECDA5AE8FC5A27B68321CCAD6E50D3A2ECA4C9E8C7B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GlobalSign Root CA

- Subject: countryName=BE, organizationName=GlobalSign nv-sa, organizationalUnitName=Root CA, commonName=GlobalSign Root CA
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 040000000001444EF0464E
- SHA-256: A8CC00DEEF9E19F74CCEAE192B86FE2E3D1A01391BBB01DD62A0438DD07501A7
- SPKI SHA-256: 2BCEE858158CF5465FC9D76F0DFA312FEF25A4DCA8501DA9B46B67D1FBFA1B64
- Validity: 2014-02-20 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.globalsign.com/rootr2
- CRL DP: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:44:4e:f0:46:4e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 20 10:00:00 2014 GMT
            Not After : Dec 15 08:00:00 2021 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.globalsign.net/repository/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/root-r2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.globalsign.com/rootr2
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A8CC00DEEF9E19F74CCEAE192B86FE2E3D1A01391BBB01DD62A0438DD07501A7
    SPKI SHA256: 2BCEE858158CF5465FC9D76F0DFA312FEF25A4DCA8501DA9B46B67D1FBFA1B64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.globalsign.com/rootr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.globalsign.net/root-r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Google Internet Authority G3

- Subject: countryName=US, organizationName=Google Trust Services, commonName=Google Internet Authority G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E3A9301CFC7206383F9A531D
- SHA-256: BE0CCD54D4CECDA1BD5E5D9ECC85A04C2C1F93A5220D77FDE88FE9AD081F641B
- SPKI SHA-256: 7FC36710567143813114E85237B122156B62B9D650543DA863AD2E6AE57F9FBF
- Validity: 2017-06-15 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr2
- CRL DP: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:a9:30:1c:fc:72:06:38:3f:9a:53:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:42 2017 GMT
            Not After : Dec 15 00:00:42 2021 GMT
        Subject: C = US, O = Google Trust Services, CN = Google Internet Authority G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:C2:B8:50:9A:67:76:76:B1:2D:C2:86:D0:83:A0:7E:A6:7E:BA:4B
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr2/gsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BE0CCD54D4CECDA1BD5E5D9ECC85A04C2C1F93A5220D77FDE88FE9AD081F641B
    SPKI SHA256: 7FC36710567143813114E85237B122156B62B9D650543DA863AD2E6AE57F9FBF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### Google Internet Authority G3

- Subject: countryName=US, organizationName=Google Inc, commonName=Google Internet Authority G3
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 30129BFD80D193D6B3E234E4
- SHA-256: 98DA042CEB04BA52E9E4D7C61E43BD76F94E88DCFF8EF1EF73520DEB6F981B82
- SPKI SHA-256: 7FC36710567143813114E85237B122156B62B9D650543DA863AD2E6AE57F9FBF
- Validity: 2017-02-25 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr2
- CRL DP: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:12:9b:fd:80:d1:93:d6:b3:e2:34:e4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Feb 25 00:00:42 2017 GMT
            Not After : Dec 15 00:00:42 2021 GMT
        Subject: C = US, O = Google Inc, CN = Google Internet Authority G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:C2:B8:50:9A:67:76:76:B1:2D:C2:86:D0:83:A0:7E:A6:7E:BA:4B
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr2/gsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98DA042CEB04BA52E9E4D7C61E43BD76F94E88DCFF8EF1EF73520DEB6F981B82
    SPKI SHA256: 7FC36710567143813114E85237B122156B62B9D650543DA863AD2E6AE57F9FBF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### Google Internet Authority G3 ECC

- Subject: countryName=US, organizationName=Google Trust Services, commonName=Google Internet Authority G3 ECC
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E3AE8026DB5B41E256C2A351
- SHA-256: 6172773E0B60BBE748D05E75B949517E30668D3F6F4B9C0345226F67F2F75A9C
- SPKI SHA-256: 7A41BCFCFA12AA37CABA739A4BD888CD1DE1640269B5624A57B0A0CAB88EF8C0
- Validity: 2017-06-15 to 2027-06-15
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr4
- CRL DP: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:ae:80:26:db:5b:41:e2:56:c2:a3:51
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:42 2017 GMT
            Not After : Jun 15 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services, CN = Google Internet Authority G3 ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                64:B8:34:04:8E:DE:E3:2A:54:39:A4:3E:C7:9B:D8:00:0F:0C:22:E4
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr4/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 6172773E0B60BBE748D05E75B949517E30668D3F6F4B9C0345226F67F2F75A9C
    SPKI SHA256: 7A41BCFCFA12AA37CABA739A4BD888CD1DE1640269B5624A57B0A0CAB88EF8C0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr4
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- expires_within_398_days

### GTS CA 1C3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1C3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 0203BC53596B34C718F5015066
- SHA-256: 23ECB03EEC17338C4E33A6B48A41DC3CDA12281BBC3FF813C0589D6CC2387522
- SPKI SHA-256: CC24E77CBC0B29B4BD4B6B1BA7EB85CF82993A8705BD7C64574E827BD3B9336C
- Validity: 2020-08-13 to 2027-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:bc:53:59:6b:34:c7:18:f5:01:50:66
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Aug 13 00:00:42 2020 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                8A:74:7F:AF:85:CD:EE:95:CD:3D:9C:D0:E2:46:14:F3:71:35:1D:27
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr1.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 23ECB03EEC17338C4E33A6B48A41DC3CDA12281BBC3FF813C0589D6CC2387522
    SPKI SHA256: CC24E77CBC0B29B4BD4B6B1BA7EB85CF82993A8705BD7C64574E827BD3B9336C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr1.der
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 1D2

- Subject: countryName=US, organizationName=Google Trust Services, commonName=GTS CA 1D2
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E3B49D77CDF40C061916B6E3
- SHA-256: D57084C1279873271EB2CE7B8415A41CE9126B544D8518BAD87FF1CE5A604DA3
- SPKI SHA-256: A8F7AB238B8CC18D55AED444E5A058F23210268A4B52E06DDBE183516330667E
- Validity: 2017-06-15 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr2
- CRL DP: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:b4:9d:77:cd:f4:0c:06:19:16:b6:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:42 2017 GMT
            Not After : Dec 15 00:00:42 2021 GMT
        Subject: C = US, O = Google Trust Services, CN = GTS CA 1D2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B1:DD:32:5D:E8:B7:37:72:D2:CE:5C:CE:26:FE:47:79:E2:01:08:E9
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr2/gsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D57084C1279873271EB2CE7B8415A41CE9126B544D8518BAD87FF1CE5A604DA3
    SPKI SHA256: A8F7AB238B8CC18D55AED444E5A058F23210268A4B52E06DDBE183516330667E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.pki.goog/gsr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GTS CA 1D4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 02008EB2023336658B64CDDB9B
- SHA-256: 64E286B76063602A372EFD60CDE8DB2656A49EE15E84254B3D6EB5FE38F4288B
- SPKI SHA-256: 7178CF80A7557BA8A88CFF2CD18409DEBB660C51D39D8671718BE660616260C1
- Validity: 2020-08-13 to 2027-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:00:8e:b2:02:33:36:65:8b:64:cd:db:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Aug 13 00:00:42 2020 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 1D4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                25:E2:18:0E:B2:57:91:94:2A:E5:D4:5D:86:90:83:DE:53:B3:B8:92
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr1.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 64E286B76063602A372EFD60CDE8DB2656A49EE15E84254B3D6EB5FE38F4288B
    SPKI SHA256: 7178CF80A7557BA8A88CFF2CD18409DEBB660C51D39D8671718BE660616260C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr1.der
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 1D8

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D8
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 0219C15AC025A1B0A5C1D9D501
- SHA-256: C0E8B1C195CDFF7B5137B9AD3513A6120B1DBFF49E5E0A8CEA3273BC8D761877
- SPKI SHA-256: 99415260CB078D07EE2AB7AEC7C2CC6EEDA60C6D603AB4BA9623597D3DDD4927
- Validity: 2022-10-05 to 2027-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- CRL DP: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:19:c1:5a:c0:25:a1:b0:a5:c1:d9:d5:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Oct  5 00:00:42 2022 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 1D8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                90:F8:50:FA:E7:90:25:C9:E4:27:7D:12:DD:47:58:E7:74:0F:B6:6A
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr2
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr2.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr2/gtsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C0E8B1C195CDFF7B5137B9AD3513A6120B1DBFF49E5E0A8CEA3273BC8D761877
    SPKI SHA256: 99415260CB078D07EE2AB7AEC7C2CC6EEDA60C6D603AB4BA9623597D3DDD4927
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr2.der
- CRL Distribution Points: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 1D9

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1D9
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 7F57F38B771162561FB3C18D61E5D8B9
- SHA-256: 02609E88979FC6862EA1571F3BC6DF6C70F2FE9277473E43FE04C3597C43431D
- SPKI SHA-256: 5618A89D4E00A4A48E0E3930C52CD119A89E9F5720DCA84E01A4D7D2C133A80E
- Validity: 2023-08-24 to 2027-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- CRL DP: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:57:f3:8b:77:11:62:56:1f:b3:c1:8d:61:e5:d8:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Aug 24 00:00:00 2023 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 1D9
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4A:D0:A4:81:55:6E:16:D7:0B:25:78:5F:AA:9C:39:18:05:3B:A0:AE
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr2
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr2.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr2/gtsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 02609E88979FC6862EA1571F3BC6DF6C70F2FE9277473E43FE04C3597C43431D
    SPKI SHA256: 5618A89D4E00A4A48E0E3930C52CD119A89E9F5720DCA84E01A4D7D2C133A80E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr2.der
- CRL Distribution Points: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 1O1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=GTS CA 1O1
- Issuer: organizationalUnitName=GlobalSign Root CA - R2, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 01E3B49AA18D8AA981256950B8
- SHA-256: 95C074E35902A14ABD9D19AFB6E7F80E669FF8E2363270539D963613F04AAA21
- SPKI SHA-256: 6193E04D9FB0A0D0820885B72C7D82C5078BCC1FF59B8D907024C149D81ACA3B
- Validity: 2017-06-15 to 2021-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr2
- CRL DP: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e3:b4:9a:a1:8d:8a:a9:81:25:69:50:b8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Jun 15 00:00:42 2017 GMT
            Not After : Dec 15 00:00:42 2021 GMT
        Subject: C = US, O = Google Trust Services, CN = GTS CA 1O1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                98:D1:F8:6E:10:EB:CF:9B:EC:60:9F:18:90:1B:A0:EB:7D:09:FD:2B
            X509v3 Authority Key Identifier:
                9B:E2:07:57:67:1C:1E:C0:6A:06:DE:59:B4:9A:2D:DF:DC:19:86:2E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr2/gsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 95C074E35902A14ABD9D19AFB6E7F80E669FF8E2363270539D963613F04AAA21
    SPKI SHA256: 6193E04D9FB0A0D0820885B72C7D82C5078BCC1FF59B8D907024C149D81ACA3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gsr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gsr2/gsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- is_expired

### GTS CA 1P5

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 1P5
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 0203BC50A32753F0918022EDF1
- SHA-256: 97D42003E132552946097F20EF955F5B1CD570AA4372D780033A65EFBE69758D
- SPKI SHA-256: F3559FD766DC2E51474007C996EC67CD9E85AE0FA827D3D663F5ABC2EAFCBE24
- Validity: 2020-08-13 to 2027-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:03:bc:50:a3:27:53:f0:91:80:22:ed:f1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Aug 13 00:00:42 2020 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 1P5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D5:FC:9E:0D:DF:1E:CA:DD:08:97:97:6E:2B:C5:5F:C5:2B:F5:EC:B8
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr1.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 97D42003E132552946097F20EF955F5B1CD570AA4372D780033A65EFBE69758D
    SPKI SHA256: F3559FD766DC2E51474007C996EC67CD9E85AE0FA827D3D663F5ABC2EAFCBE24
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.11129.2.5.3, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr1.der
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 2A1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2A1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 02008EB258E7B5940C1FF90044
- SHA-256: 11C697878732056DE17C1DA134E9D2B6D23CF1DE95B3FB0A4D18A517AB63230A
- SPKI SHA-256: 744A7F19CDCC7B483642702DA4735CB3AF7634507245F17B39DD0AD93BB01B56
- Validity: 2020-08-13 to 2025-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- CRL DP: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:00:8e:b2:58:e7:b5:94:0c:1f:f9:00:44
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Aug 13 00:00:42 2020 GMT
            Not After : Sep 30 00:00:42 2025 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2A1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                93:18:63:91:17:76:9A:5A:E6:3B:7F:2E:33:83:84:86:6B:1E:D4:F9
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr4
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr4.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr4/gtsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3.1
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 11C697878732056DE17C1DA134E9D2B6D23CF1DE95B3FB0A4D18A517AB63230A
    SPKI SHA256: 744A7F19CDCC7B483642702DA4735CB3AF7634507245F17B39DD0AD93BB01B56
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3.1
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr4.der
- CRL Distribution Points: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GTS CA 2D3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 021668D8D65BC4320E5B8E5E76
- SHA-256: 57BE32D0638809F1CB7C6B58D57CFFAEB99774B1F0B57D6A3708923954A54824
- SPKI SHA-256: 36A2A4AE7509712F64A8D4E5586453618491F209BD55D782AB4B6BA307C8D42A
- Validity: 2022-10-05 to 2027-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- CRL DP: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:16:68:d8:d6:5b:c4:32:0e:5b:8e:5e:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Oct  5 00:00:42 2022 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2D3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BF:A9:53:BF:1B:69:D8:85:29:34:9A:69:43:CB:D6:7A:D4:99:FF:6D
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr3
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr3.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr3/gtsr3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 57BE32D0638809F1CB7C6B58D57CFFAEB99774B1F0B57D6A3708923954A54824
    SPKI SHA256: 36A2A4AE7509712F64A8D4E5586453618491F209BD55D782AB4B6BA307C8D42A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr3.der
- CRL Distribution Points: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 2D4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 021668F1CD0A2A8F847D8AAD34
- SHA-256: 834B5BE6BD66A404F68F6EC9DE1C1E5C5723DDA65A7D3F66FB6209969D8854D8
- SPKI SHA-256: F8B17DC824E3CB92D8EDE2459F621806E3DC3B29BB29E7D95C4C7CB87E4507B4
- Validity: 2022-10-05 to 2027-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr4
- CRL DP: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:16:68:f1:cd:0a:2a:8f:84:7d:8a:ad:34
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Oct  5 00:00:42 2022 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2D4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A8:88:D9:8A:39:AC:65:D5:82:4B:37:A8:95:6C:65:43:CD:44:01:E0
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr4
                CA Issuers - URI:http://pki.goog/repo/certs/gsr4.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr4/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 834B5BE6BD66A404F68F6EC9DE1C1E5C5723DDA65A7D3F66FB6209969D8854D8
    SPKI SHA256: F8B17DC824E3CB92D8EDE2459F621806E3DC3B29BB29E7D95C4C7CB87E4507B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gsr4
- AIA CA Issuers: http://pki.goog/repo/certs/gsr4.der
- CRL Distribution Points: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 2D5

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D5
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7F57F3C4CA39F4BEC6649F26E77E82D4
- SHA-256: EDBCDD01698D83EAFA1E3D38F017B3AD96B2D8D88E746C58011CEE0EF106939C
- SPKI SHA-256: 6A173437B6C66320CC9B180181E877B61A0AF7427EFCB48DC316C6F849EA7D4D
- Validity: 2023-08-24 to 2027-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gsr4
- CRL DP: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:57:f3:c4:ca:39:f4:be:c6:64:9f:26:e7:7e:82:d4
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Aug 24 00:00:00 2023 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2D5
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                15:56:BF:F2:45:3E:18:C4:8E:15:C6:0F:3E:C7:21:28:4B:0A:85:7C
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gsr4
                CA Issuers - URI:http://pki.goog/repo/certs/gsr4.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gsr4/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: EDBCDD01698D83EAFA1E3D38F017B3AD96B2D8D88E746C58011CEE0EF106939C
    SPKI SHA256: 6A173437B6C66320CC9B180181E877B61A0AF7427EFCB48DC316C6F849EA7D4D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gsr4
- AIA CA Issuers: http://pki.goog/repo/certs/gsr4.der
- CRL Distribution Points: http://crl.pki.goog/gsr4/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 2D6

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2D6
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 7F57F3D2EAF1C0CBA691B003C9FBD0A4
- SHA-256: F5D12415A12C07FDE93BD6F9E4E4588E03D20596E4F8A5E9D213A83364BCEE71
- SPKI SHA-256: 98627282A4256807564CA07C5B7E4983FC5B616FFBCE92F8E4F8A20DDD70D2A1
- Validity: 2023-08-24 to 2027-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- CRL DP: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:57:f3:d2:ea:f1:c0:cb:a6:91:b0:03:c9:fb:d0:a4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Aug 24 00:00:00 2023 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2D6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:D3:4F:A0:4D:E8:72:A6:5A:16:C1:2D:F6:0A:0E:E4:68:21:AE:7E
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr3
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr3.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr3/gtsr3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F5D12415A12C07FDE93BD6F9E4E4588E03D20596E4F8A5E9D213A83364BCEE71
    SPKI SHA256: 98627282A4256807564CA07C5B7E4983FC5B616FFBCE92F8E4F8A20DDD70D2A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr3.der
- CRL Distribution Points: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS CA 2P2

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS CA 2P2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 02166825E1700440612491F540
- SHA-256: 3647AAC2B282BC941FE7A642E3DCB99CFC5B3C6DCE944A1E96F8028E89B7B090
- SPKI SHA-256: 75544535970AE4D5BAE64DD354FA82762AC16522D96D0F0523BC38A60F737163
- Validity: 2022-10-05 to 2027-09-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- CRL DP: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:16:68:25:e1:70:04:40:61:24:91:f5:40
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Oct  5 00:00:42 2022 GMT
            Not After : Sep 30 00:00:42 2027 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS CA 2P2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:23:A9:50:48:0E:07:89:54:0A:71:30:F6:33:D2:0A:47:F6:9D:AC
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr4
                CA Issuers - URI:http://pki.goog/repo/certs/gtsr4.der
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr4/gtsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3647AAC2B282BC941FE7A642E3DCB99CFC5B3C6DCE944A1E96F8028E89B7B090
    SPKI SHA256: 75544535970AE4D5BAE64DD354FA82762AC16522D96D0F0523BC38A60F737163
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.3.6.1.4.1.11129.2.5.3
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- AIA CA Issuers: http://pki.goog/repo/certs/gtsr4.der
- CRL Distribution Points: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS X1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 6E47A9C9A553E3C2CE1F144ED77DACE7
- SHA-256: C2864EAB2306A57B2CDA90F1557EACDB88B302D8EE499A5AE938EF6725CBE2B1
- SPKI SHA-256: DB8A328A7AFC50ECFAFDA60D0F8124ED5624170904BBA6130A71BFF4A8691B9D
- Validity: 2016-06-22 to 2026-06-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:c9:a5:53:e3:c2:ce:1f:14:4e:d7:7d:ac:e7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2026 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS X1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                10:0A:72:B4:18:60:9B:33:69:E4:FE:8B:B0:DF:D2:0D:8B:D8:E5:53
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C2864EAB2306A57B2CDA90F1557EACDB88B302D8EE499A5AE938EF6725CBE2B1
    SPKI SHA256: DB8A328A7AFC50ECFAFDA60D0F8124ED5624170904BBA6130A71BFF4A8691B9D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GTS X2

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 6E47A9CACE7F8465192EE7332B2727C3
- SHA-256: AA2CF140B325C578D6BA6115FA83A338AC335E27453CF7A91A635CFED5448D4B
- SPKI SHA-256: EF2594B6E6533ADC56E6B13841CECFA7B89F636FC565C1AD9457689F5A568EDD
- Validity: 2016-06-22 to 2026-06-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- CRL DP: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:ca:ce:7f:84:65:19:2e:e7:33:2b:27:27:c3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2026 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS X2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0A:88:47:41:60:20:4C:AB:69:09:1E:AE:B4:66:8B:35:1F:65:B9:67
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr2/gtsr2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://pki.goog/repository/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA2CF140B325C578D6BA6115FA83A338AC335E27453CF7A91A635CFED5448D4B
    SPKI SHA256: EF2594B6E6533ADC56E6B13841CECFA7B89F636FC565C1AD9457689F5A568EDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GTS X3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 6E47A9CCB45A29C7B078D01BA3211261
- SHA-256: EB73A16A1D61DD86186878EB2BC3485D1C0CA5F04E55E4FDA13785CD6C8FBCB0
- SPKI SHA-256: 8ABB192FD6FA86EDE1E4E7B8FA1773A32D31D090AB9C04845B4FD9268C5C020E
- Validity: 2016-06-22 to 2026-06-22
- Key: RSA 2048
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- CRL DP: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:cc:b4:5a:29:c7:b0:78:d0:1b:a3:21:12:61
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2026 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS X3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:98:B3:74:B5:17:3C:32:3A:FE:F4:F6:64:B1:B1:68:C3:80:C0:5A
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr3/gtsr3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: EB73A16A1D61DD86186878EB2BC3485D1C0CA5F04E55E4FDA13785CD6C8FBCB0
    SPKI SHA256: 8ABB192FD6FA86EDE1E4E7B8FA1773A32D31D090AB9C04845B4FD9268C5C020E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GTS X4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS X4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 6E47A9CE4F46C23DE249EACC38945373
- SHA-256: F5ABD3F1C6667C370E24D737EF891C9D64CEB66AC0DE661D425ED365BB961091
- SPKI SHA-256: 71A6BF3AE06403E120FE30354720AFAD528EC4757CAF39A6E45BCCD68F9CB2AF
- Validity: 2016-06-22 to 2026-06-22
- Key: RSA 2048
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- CRL DP: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:47:a9:ce:4f:46:c2:3d:e2:49:ea:cc:38:94:53:73
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Jun 22 00:00:00 2016 GMT
            Not After : Jun 22 00:00:00 2026 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS X4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FE:9C:9C:0E:77:C1:48:11:0D:7C:19:0A:25:D5:E2:AB:64:57:DF:65
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr4/gtsr4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://pki.goog/repository/
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F5ABD3F1C6667C370E24D737EF891C9D64CEB66AC0DE661D425ED365BB961091
    SPKI SHA256: 71A6BF3AE06403E120FE30354720AFAD528EC4757CAF39A6E45BCCD68F9CB2AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### GTS Y1

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 01F0F79D5E7827FB40A912B310
- SHA-256: 7D740341B5193F53E675E3A1E3B4B1095E602509F65A5FA7576B0E3A5470F9C6
- SPKI SHA-256: 57B5B18F3D6A82AC6D1DD3F64263DD2C8B6FDB346327BF5997537A5FB4D81D50
- Validity: 2018-11-01 to 2028-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GTSY1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- CRL DP: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:f7:9d:5e:78:27:fb:40:a9:12:b3:10
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Nov  1 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                86:22:10:5D:85:60:25:F2:3A:1E:7D:0A:AF:61:2A:B3:15:1A:0A:77
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr1
                CA Issuers - URI:http://pki.goog/gtsr1/gtsr1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr1/gtsr1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7D740341B5193F53E675E3A1E3B4B1095E602509F65A5FA7576B0E3A5470F9C6
    SPKI SHA256: 57B5B18F3D6A82AC6D1DD3F64263DD2C8B6FDB346327BF5997537A5FB4D81D50
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr1
- AIA CA Issuers: http://pki.goog/gtsr1/gtsr1.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr1/gtsr1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Y2

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 01F09C5B0EA22937CF9EE4416C
- SHA-256: 9C30516496E125B3D0931F49875E29516D9DC25473E5D6A106C1FCF866D306DB
- SPKI SHA-256: CD8188929A0D423FC0F0CAD257B073B9B65D0EA124F4B90B8008FCB7CFD4FE7B
- Validity: 2018-11-01 to 2028-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GTSY2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- CRL DP: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:9c:5b:0e:a2:29:37:cf:9e:e4:41:6c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Nov  1 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6D:65:A2:D7:F3:50:8F:09:78:65:B1:62:A2:BE:3C:ED:BB:46:3A:35
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr2
                CA Issuers - URI:http://pki.goog/gtsr2/gtsr2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr2/gtsr2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9C30516496E125B3D0931F49875E29516D9DC25473E5D6A106C1FCF866D306DB
    SPKI SHA256: CD8188929A0D423FC0F0CAD257B073B9B65D0EA124F4B90B8008FCB7CFD4FE7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr2
- AIA CA Issuers: http://pki.goog/gtsr2/gtsr2.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr2/gtsr2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Y3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 01F09C5B452806A4BB42822065
- SHA-256: 0715C5787344FF4D27C4E79D2AFD91DD38A642D4CF0D9828B12620A62F52659E
- SPKI SHA-256: 2DB7236970DDCD26CE98B44A58AB86592A9DE93E10B8D549C2703F4580FD6B59
- Validity: 2018-11-01 to 2028-11-01
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- CRL DP: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:9c:5b:45:28:06:a4:bb:42:82:20:65
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Nov  1 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AA:63:D5:82:17:3D:34:53:3C:45:40:4C:8C:25:DA:87:BC:D1:9E:1E
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr3
                CA Issuers - URI:http://pki.goog/gtsr3/gtsr3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr3/gtsr3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 0715C5787344FF4D27C4E79D2AFD91DD38A642D4CF0D9828B12620A62F52659E
    SPKI SHA256: 2DB7236970DDCD26CE98B44A58AB86592A9DE93E10B8D549C2703F4580FD6B59
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- AIA CA Issuers: http://pki.goog/gtsr3/gtsr3.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Y3

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 01FEA580C258A731CBC3B39EAB
- SHA-256: 181DC8BE7E91EDF163E66CC3FAD14D979A6DAE53B556DAEE8F7DCA0E114C14F6
- SPKI SHA-256: 2DB7236970DDCD26CE98B44A58AB86592A9DE93E10B8D549C2703F4580FD6B59
- Validity: 2020-01-30 to 2030-01-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GTSY3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- CRL DP: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:fe:a5:80:c2:58:a7:31:cb:c3:b3:9e:ab
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Jan 30 00:00:42 2020 GMT
            Not After : Jan 30 00:00:42 2030 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AA:63:D5:82:17:3D:34:53:3C:45:40:4C:8C:25:DA:87:BC:D1:9E:1E
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr3
                CA Issuers - URI:http://pki.goog/gtsr3/gtsr3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr3/gtsr3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 181DC8BE7E91EDF163E66CC3FAD14D979A6DAE53B556DAEE8F7DCA0E114C14F6
    SPKI SHA256: 2DB7236970DDCD26CE98B44A58AB86592A9DE93E10B8D549C2703F4580FD6B59
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr3
- AIA CA Issuers: http://pki.goog/gtsr3/gtsr3.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr3/gtsr3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Y4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 01F09C5B7005A6DC86E2F99EF3
- SHA-256: 55BAB3C516D50E7F35F86EA948A7CCDF7D5EE680EAA9AB49FA258A614CD1FADE
- SPKI SHA-256: 1D2D37991C1B1B05937E4FA0EFD2F5EFFD06327ED17795DA735D01725255F3F4
- Validity: 2018-11-01 to 2028-11-01
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- CRL DP: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:f0:9c:5b:70:05:a6:dc:86:e2:f9:9e:f3
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Nov  1 00:00:42 2018 GMT
            Not After : Nov  1 00:00:42 2028 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B4:A7:99:8A:F8:91:49:AC:8E:58:B9:B3:5E:4F:CC:70:98:CD:22:67
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr4
                CA Issuers - URI:http://pki.goog/gtsr4/gtsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr4/gtsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 55BAB3C516D50E7F35F86EA948A7CCDF7D5EE680EAA9AB49FA258A614CD1FADE
    SPKI SHA256: 1D2D37991C1B1B05937E4FA0EFD2F5EFFD06327ED17795DA735D01725255F3F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- AIA CA Issuers: http://pki.goog/gtsr4/gtsr4.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GTS Y4

- Subject: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Y4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 01FEA581447E3BFD3BB81C2498
- SHA-256: 28676200C415D82D10251F527A773E7E7AC9902232FABA43E1A68C5AD3B7D87D
- SPKI SHA-256: 1D2D37991C1B1B05937E4FA0EFD2F5EFFD06327ED17795DA735D01725255F3F4
- Validity: 2020-01-30 to 2030-01-30
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pki.goog/GTSY4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- CRL DP: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:fe:a5:81:44:7e:3b:fd:3b:b8:1c:24:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Jan 30 00:00:42 2020 GMT
            Not After : Jan 30 00:00:42 2030 GMT
        Subject: C = US, O = Google Trust Services LLC, CN = GTS Y4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B4:A7:99:8A:F8:91:49:AC:8E:58:B9:B3:5E:4F:CC:70:98:CD:22:67
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/gtsr4
                CA Issuers - URI:http://pki.goog/gtsr4/gtsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pki.goog/gtsr4/gtsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 28676200C415D82D10251F527A773E7E7AC9902232FABA43E1A68C5AD3B7D87D
    SPKI SHA256: 1D2D37991C1B1B05937E4FA0EFD2F5EFFD06327ED17795DA735D01725255F3F4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.pki.goog/gtsr4
- AIA CA Issuers: http://pki.goog/gtsr4/gtsr4.crt
- CRL Distribution Points: http://crl.pki.goog/gtsr4/gtsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MR1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=MR1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 7FF4E5CF7619B94F30F8A47FF8749148
- SHA-256: BDF40C618E862D9B6B52718A1FB35BB951DFDBD2428B17D8A3FC64DF9E5DF355
- SPKI SHA-256: D87E586ABBA832B6046539E6C9BEFC39E5551AE4B8054EF5627CEB8DF1F7DC86
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/mr1/Iq-8PJNm3tQ.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f4:e5:cf:76:19:b9:4f:30:f8:a4:7f:f8:74:91:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = MR1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9A:54:1A:66:69:C3:0C:DA:53:5C:16:53:6A:13:FE:62:0E:80:3F:F1
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BDF40C618E862D9B6B52718A1FB35BB951DFDBD2428B17D8A3FC64DF9E5DF355
    SPKI SHA256: D87E586ABBA832B6046539E6C9BEFC39E5551AE4B8054EF5627CEB8DF1F7DC86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.3
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r2.crt
- CRL Distribution Points: http://c.pki.goog/r/r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### WE1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 7FF31977972C224A76155D13B6D685E3
- SHA-256: 1DFC1605FBAD358D8BC844F76D15203FAC9CA5C1A79FD4857FFAF2864FBEBF96
- SPKI SHA-256: 908769E8D34477CC2CBA0632C88605B22D7294C0840F78596D247C645B1AFC0E
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we1/-9wMmZBDoQg.crl, http://c.pki.goog/we1/-A4QIxeBtHI.crl, http://c.pki.goog/we1/-Yj7OYL5Dng.crl, http://c.pki.goog/we1/-hiVeOStiWo.crl, http://c.pki.goog/we1/-wlfVjh9dJg.crl, http://c.pki.goog/we1/-yOI8u4J3dM.crl, http://c.pki.goog/we1/08QUUo4RO8M.crl, http://c.pki.goog/we1/0QJ4fZUR2VY.crl, http://c.pki.goog/we1/0b07lKySgU0.crl, http://c.pki.goog/we1/0rbAgG3gMgU.crl, http://c.pki.goog/we1/19WWHKnVoyI.crl, http://c.pki.goog/we1/1cHiUjpZkhI.crl, http://c.pki.goog/we1/1yJFccB11d0.crl, http://c.pki.goog/we1/28vQ5X_fK3c.crl, http://c.pki.goog/we1/2DqfS24kcdI.crl, http://c.pki.goog/we1/2Yc9DoenKIc.crl, http://c.pki.goog/we1/2xoHs2_pwfc.crl, http://c.pki.goog/we1/37BFu49bNWI.crl, http://c.pki.goog/we1/3GLBlt0L46Q.crl, http://c.pki.goog/we1/3r1KF9eJ6iQ.crl, http://c.pki.goog/we1/4GA79upiEbo.crl, http://c.pki.goog/we1/4y3jdVkomeg.crl, http://c.pki.goog/we1/5RpMhq5ShrY.crl, http://c.pki.goog/we1/6FL0xFPZ9Sk.crl, http://c.pki.goog/we1/6Xs4idXq35U.crl, http://c.pki.goog/we1/6lexwfD8peQ.crl, http://c.pki.goog/we1/7b10WPOaClM.crl, http://c.pki.goog/we1/7ifRWgQvmOI.crl, http://c.pki.goog/we1/7jtea6h-Ubk.crl, http://c.pki.goog/we1/85f1_-NSq0w.crl, http://c.pki.goog/we1/8GJyPhuLa-4.crl, http://c.pki.goog/we1/8JmyPB8gmEc.crl, http://c.pki.goog/we1/8cGe9Jem4W0.crl, http://c.pki.goog/we1/8gV5WKrIGR0.crl, http://c.pki.goog/we1/8iOxSmD0E50.crl, http://c.pki.goog/we1/8w4XLPYe6tU.crl, http://c.pki.goog/we1/9NmpkWSoEMc.crl, http://c.pki.goog/we1/A4NN7G_5v7M.crl, http://c.pki.goog/we1/AHWhP7ZvfeI.crl, http://c.pki.goog/we1/AVf_tp6YFrE.crl, http://c.pki.goog/we1/B4I2HAQtq0U.crl, http://c.pki.goog/we1/BH5itOT96Ec.crl, http://c.pki.goog/we1/BMVG_XL0l_M.crl, http://c.pki.goog/we1/BR1mWoHyxgA.crl, http://c.pki.goog/we1/BX7jaHAMPC8.crl, http://c.pki.goog/we1/B_qrX3vjhsQ.crl, http://c.pki.goog/we1/BwYkd5XkY8c.crl, http://c.pki.goog/we1/Cay6pay1xIs.crl, http://c.pki.goog/we1/CjXVS9991mc.crl, http://c.pki.goog/we1/D5wY4w1Bdqo.crl, http://c.pki.goog/we1/DDVSLhL8ZOU.crl, http://c.pki.goog/we1/DP2PS8zQnVs.crl, http://c.pki.goog/we1/ER6WRo4TM5k.crl, http://c.pki.goog/we1/FARePxy0M2M.crl, http://c.pki.goog/we1/FB2V25zoX8s.crl, http://c.pki.goog/we1/FucB3_abY94.crl, http://c.pki.goog/we1/G0k-BqpOX8k.crl, http://c.pki.goog/we1/G3vAlQ3kj_4.crl, http://c.pki.goog/we1/GK262UYkhtE.crl, http://c.pki.goog/we1/H9bdJBu1Tvg.crl, http://c.pki.goog/we1/Hk21MYmfQqY.crl, http://c.pki.goog/we1/HsC3SBHwREo.crl, http://c.pki.goog/we1/HwtnZoT0RaI.crl, http://c.pki.goog/we1/JTwPdch_eC8.crl, http://c.pki.goog/we1/JWW3Gj56Zd4.crl, http://c.pki.goog/we1/K0UVAKe5N94.crl, http://c.pki.goog/we1/KAimmlFj7xM.crl, http://c.pki.goog/we1/KLRFxSqxaMw.crl, http://c.pki.goog/we1/Kvu7cf9_d_4.crl, http://c.pki.goog/we1/LCLN8rQ4qe0.crl, http://c.pki.goog/we1/LTZ9nL9sQRA.crl, http://c.pki.goog/we1/LcT3rMT9KpM.crl, http://c.pki.goog/we1/M33OnOmlXcY.crl, http://c.pki.goog/we1/NSADtTurT7Y.crl, http://c.pki.goog/we1/OhMZjmT1BfY.crl, http://c.pki.goog/we1/OmlxXM-QJxU.crl, http://c.pki.goog/we1/OpMCQT6sVwg.crl, http://c.pki.goog/we1/OuqGbJkzwhU.crl, http://c.pki.goog/we1/PCUeQViQlYc.crl, http://c.pki.goog/we1/Pmn3y1aCZAo.crl, http://c.pki.goog/we1/QfwDhc9dNKY.crl, http://c.pki.goog/we1/QnuDYkUfA5s.crl, http://c.pki.goog/we1/QoqFz1z0bWA.crl, http://c.pki.goog/we1/R3uyA_0OtKA.crl, http://c.pki.goog/we1/R7LgAnKD4Lk.crl, http://c.pki.goog/we1/S5C6cZxkWsc.crl, http://c.pki.goog/we1/SXiTs4pnn2c.crl, http://c.pki.goog/we1/SaWLYV2xvlI.crl, http://c.pki.goog/we1/Sf6VE40mPgw.crl, http://c.pki.goog/we1/T0VkE8LAbR8.crl, http://c.pki.goog/we1/T58q3x0jyXI.crl, http://c.pki.goog/we1/TQRRitNQZa8.crl, http://c.pki.goog/we1/TZg9FK9zoSc.crl, http://c.pki.goog/we1/TgxXJzCQ3Ko.crl, http://c.pki.goog/we1/TtOTTrC8vRQ.crl, http://c.pki.goog/we1/U2k3Nbjapas.crl, http://c.pki.goog/we1/UIumR6EfnvM.crl, http://c.pki.goog/we1/UNvP7iUHXM0.crl, http://c.pki.goog/we1/USODfqcOxVM.crl, http://c.pki.goog/we1/Un79Lm4-K_s.crl, http://c.pki.goog/we1/V4D0AIkfl2I.crl, http://c.pki.goog/we1/Vb9kwdkpRtY.crl, http://c.pki.goog/we1/WCuuEb_Odnw.crl, http://c.pki.goog/we1/WyINKZSbmqk.crl, http://c.pki.goog/we1/X2M_FEd6Z7c.crl, http://c.pki.goog/we1/XWPkyQXvHmQ.crl, http://c.pki.goog/we1/Xw7k995BvVg.crl, http://c.pki.goog/we1/YH8nvPoZu_g.crl, http://c.pki.goog/we1/YLlS1L_ZkKk.crl, http://c.pki.goog/we1/Yh_eO4rxBDg.crl, http://c.pki.goog/we1/Yic14q9XRBo.crl, http://c.pki.goog/we1/YzYruHDXVK0.crl, http://c.pki.goog/we1/ZIovFvGuJMU.crl, http://c.pki.goog/we1/ZjcHv8Zi2GA.crl, http://c.pki.goog/we1/ZkjzUXKCUwU.crl, http://c.pki.goog/we1/_-4iFwfCacM.crl, http://c.pki.goog/we1/_6YJ-enHw1Y.crl, http://c.pki.goog/we1/_MYRZUBtxZI.crl, http://c.pki.goog/we1/_dxV1mTmoJc.crl, http://c.pki.goog/we1/_hiyWRttjyM.crl, http://c.pki.goog/we1/_xsEHlbXNIE.crl, http://c.pki.goog/we1/b4rrFg4gOhA.crl, http://c.pki.goog/we1/bCj6TXPeWec.crl, http://c.pki.goog/we1/bd2V6AJYUXg.crl, http://c.pki.goog/we1/btvd66Z9uQY.crl, http://c.pki.goog/we1/c9egY9ikPsU.crl, http://c.pki.goog/we1/cM76QZUXmE8.crl, http://c.pki.goog/we1/dpcZcgUNPbE.crl, http://c.pki.goog/we1/e19tNpFF5H4.crl, http://c.pki.goog/we1/f-LqBsO90gY.crl, http://c.pki.goog/we1/f3ewCkQVMyI.crl, http://c.pki.goog/we1/f9V0xSFiRKs.crl, http://c.pki.goog/we1/fFQtDcOPaQI.crl, http://c.pki.goog/we1/fJedmL2peto.crl, http://c.pki.goog/we1/fWa0w0sMqcA.crl, http://c.pki.goog/we1/g4x6SbHw2QQ.crl, http://c.pki.goog/we1/gxIBv6B2hYw.crl, http://c.pki.goog/we1/h_V5jn8i9Ks.crl, http://c.pki.goog/we1/hx34Vi4ORbM.crl, http://c.pki.goog/we1/hxWfeVec_R4.crl, http://c.pki.goog/we1/hyVOyYKxz9E.crl, http://c.pki.goog/we1/i4u_miZqw1E.crl, http://c.pki.goog/we1/iUnSZAxKPhw.crl, http://c.pki.goog/we1/ioCWfLly_Gg.crl, http://c.pki.goog/we1/j-6Pad2quEc.crl, http://c.pki.goog/we1/jJf4fCj886Y.crl, http://c.pki.goog/we1/jOS_4m-LORs.crl, http://c.pki.goog/we1/jQ595FtbPDk.crl, http://c.pki.goog/we1/jkIjDkDqFBc.crl, http://c.pki.goog/we1/k9D0LcQcFTo.crl, http://c.pki.goog/we1/kb6xWz-TctY.crl, http://c.pki.goog/we1/khE4z_g7LG8.crl, http://c.pki.goog/we1/lItwE7FHOOM.crl, http://c.pki.goog/we1/m4BkrTkPX5Y.crl, http://c.pki.goog/we1/m8zfv5rsnVE.crl, http://c.pki.goog/we1/mGnV4RWIzn0.crl, http://c.pki.goog/we1/mdHjcP3Bnqc.crl, http://c.pki.goog/we1/n0dx7V1Gbbo.crl, http://c.pki.goog/we1/nXrN9meVWok.crl, http://c.pki.goog/we1/o1fiiaEFTlk.crl, http://c.pki.goog/we1/p3h7Ul8wx3k.crl, http://c.pki.goog/we1/pIG1Fj9HZEw.crl, http://c.pki.goog/we1/pVHkAbbILwY.crl, http://c.pki.goog/we1/peDXaqF3Tp8.crl, http://c.pki.goog/we1/pl4XiTjSDSk.crl, http://c.pki.goog/we1/pnDlkWlcNeI.crl, http://c.pki.goog/we1/pyeoXlQPF4E.crl, http://c.pki.goog/we1/qXRwQ5LVWco.crl, http://c.pki.goog/we1/qon3-PAxUq8.crl, http://c.pki.goog/we1/r1Lq4vMcD8c.crl, http://c.pki.goog/we1/rdoZaP-CE4Y.crl, http://c.pki.goog/we1/rdt6OZTVTTg.crl, http://c.pki.goog/we1/rgeokRA_n-g.crl, http://c.pki.goog/we1/s77gqC02Wgo.crl, http://c.pki.goog/we1/t3LJbZiBtsU.crl, http://c.pki.goog/we1/t4Y_tS4oQ9A.crl, http://c.pki.goog/we1/t62Et4WE5QY.crl, http://c.pki.goog/we1/tVFs5tB-aco.crl, http://c.pki.goog/we1/tX2H5hSFwqE.crl, http://c.pki.goog/we1/tb8roZNrZ40.crl, http://c.pki.goog/we1/tqAYaqExRbM.crl, http://c.pki.goog/we1/ty82fqB0hAw.crl, http://c.pki.goog/we1/tygqm2Ip0_w.crl, http://c.pki.goog/we1/uCglcmwwftc.crl, http://c.pki.goog/we1/uIjxjnqAt90.crl, http://c.pki.goog/we1/uTOpeqvFBmY.crl, http://c.pki.goog/we1/v1q7FffOpC4.crl, http://c.pki.goog/we1/v7bAe0vWaYs.crl, http://c.pki.goog/we1/vRbdOFLardo.crl, http://c.pki.goog/we1/vUPS_N7Q7r0.crl, http://c.pki.goog/we1/vmjQnTcrfiY.crl, http://c.pki.goog/we1/vpMVCCR8pGU.crl, http://c.pki.goog/we1/xRzb4KCC9ig.crl, http://c.pki.goog/we1/x_tyL95aY0Q.crl, http://c.pki.goog/we1/xgUc4c2k3B4.crl, http://c.pki.goog/we1/xkS2PerK07g.crl, http://c.pki.goog/we1/xmLIiaFUWIY.crl, http://c.pki.goog/we1/ygWPENklvpM.crl, http://c.pki.goog/we1/yoggNsz3xQU.crl, http://c.pki.goog/we1/z1cGKjt-3q0.crl, http://c.pki.goog/we1/zl-I8PCWPFE.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:19:77:97:2c:22:4a:76:15:5d:13:b6:d6:85:e3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                90:77:92:35:67:C4:FF:A8:CC:A9:E6:7B:D9:80:79:7B:CC:93:F9:38
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1DFC1605FBAD358D8BC844F76D15203FAC9CA5C1A79FD4857FFAF2864FBEBF96
    SPKI SHA256: 908769E8D34477CC2CBA0632C88605B22D7294C0840F78596D247C645B1AFC0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r4.crt
- CRL Distribution Points: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE1
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FF357689BC24E302D90E18A41BD0E1F
- SHA-256: A287FFAB762CC69A26D482037EDF701F653CE899025C62A7E5CB88BB9B419CBB
- SPKI SHA-256: 908769E8D34477CC2CBA0632C88605B22D7294C0840F78596D247C645B1AFC0E
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we1/-9wMmZBDoQg.crl, http://c.pki.goog/we1/-A4QIxeBtHI.crl, http://c.pki.goog/we1/-Yj7OYL5Dng.crl, http://c.pki.goog/we1/-hiVeOStiWo.crl, http://c.pki.goog/we1/-wlfVjh9dJg.crl, http://c.pki.goog/we1/-yOI8u4J3dM.crl, http://c.pki.goog/we1/08QUUo4RO8M.crl, http://c.pki.goog/we1/0QJ4fZUR2VY.crl, http://c.pki.goog/we1/0b07lKySgU0.crl, http://c.pki.goog/we1/0rbAgG3gMgU.crl, http://c.pki.goog/we1/19WWHKnVoyI.crl, http://c.pki.goog/we1/1cHiUjpZkhI.crl, http://c.pki.goog/we1/1yJFccB11d0.crl, http://c.pki.goog/we1/28vQ5X_fK3c.crl, http://c.pki.goog/we1/2DqfS24kcdI.crl, http://c.pki.goog/we1/2Yc9DoenKIc.crl, http://c.pki.goog/we1/2xoHs2_pwfc.crl, http://c.pki.goog/we1/37BFu49bNWI.crl, http://c.pki.goog/we1/3GLBlt0L46Q.crl, http://c.pki.goog/we1/3r1KF9eJ6iQ.crl, http://c.pki.goog/we1/4GA79upiEbo.crl, http://c.pki.goog/we1/4y3jdVkomeg.crl, http://c.pki.goog/we1/5RpMhq5ShrY.crl, http://c.pki.goog/we1/6FL0xFPZ9Sk.crl, http://c.pki.goog/we1/6Xs4idXq35U.crl, http://c.pki.goog/we1/6lexwfD8peQ.crl, http://c.pki.goog/we1/7b10WPOaClM.crl, http://c.pki.goog/we1/7ifRWgQvmOI.crl, http://c.pki.goog/we1/7jtea6h-Ubk.crl, http://c.pki.goog/we1/85f1_-NSq0w.crl, http://c.pki.goog/we1/8GJyPhuLa-4.crl, http://c.pki.goog/we1/8JmyPB8gmEc.crl, http://c.pki.goog/we1/8cGe9Jem4W0.crl, http://c.pki.goog/we1/8gV5WKrIGR0.crl, http://c.pki.goog/we1/8iOxSmD0E50.crl, http://c.pki.goog/we1/8w4XLPYe6tU.crl, http://c.pki.goog/we1/9NmpkWSoEMc.crl, http://c.pki.goog/we1/A4NN7G_5v7M.crl, http://c.pki.goog/we1/AHWhP7ZvfeI.crl, http://c.pki.goog/we1/AVf_tp6YFrE.crl, http://c.pki.goog/we1/B4I2HAQtq0U.crl, http://c.pki.goog/we1/BH5itOT96Ec.crl, http://c.pki.goog/we1/BMVG_XL0l_M.crl, http://c.pki.goog/we1/BR1mWoHyxgA.crl, http://c.pki.goog/we1/BX7jaHAMPC8.crl, http://c.pki.goog/we1/B_qrX3vjhsQ.crl, http://c.pki.goog/we1/BwYkd5XkY8c.crl, http://c.pki.goog/we1/Cay6pay1xIs.crl, http://c.pki.goog/we1/CjXVS9991mc.crl, http://c.pki.goog/we1/D5wY4w1Bdqo.crl, http://c.pki.goog/we1/DDVSLhL8ZOU.crl, http://c.pki.goog/we1/DP2PS8zQnVs.crl, http://c.pki.goog/we1/ER6WRo4TM5k.crl, http://c.pki.goog/we1/FARePxy0M2M.crl, http://c.pki.goog/we1/FB2V25zoX8s.crl, http://c.pki.goog/we1/FucB3_abY94.crl, http://c.pki.goog/we1/G0k-BqpOX8k.crl, http://c.pki.goog/we1/G3vAlQ3kj_4.crl, http://c.pki.goog/we1/GK262UYkhtE.crl, http://c.pki.goog/we1/H9bdJBu1Tvg.crl, http://c.pki.goog/we1/Hk21MYmfQqY.crl, http://c.pki.goog/we1/HsC3SBHwREo.crl, http://c.pki.goog/we1/HwtnZoT0RaI.crl, http://c.pki.goog/we1/JTwPdch_eC8.crl, http://c.pki.goog/we1/JWW3Gj56Zd4.crl, http://c.pki.goog/we1/K0UVAKe5N94.crl, http://c.pki.goog/we1/KAimmlFj7xM.crl, http://c.pki.goog/we1/KLRFxSqxaMw.crl, http://c.pki.goog/we1/Kvu7cf9_d_4.crl, http://c.pki.goog/we1/LCLN8rQ4qe0.crl, http://c.pki.goog/we1/LTZ9nL9sQRA.crl, http://c.pki.goog/we1/LcT3rMT9KpM.crl, http://c.pki.goog/we1/M33OnOmlXcY.crl, http://c.pki.goog/we1/NSADtTurT7Y.crl, http://c.pki.goog/we1/OhMZjmT1BfY.crl, http://c.pki.goog/we1/OmlxXM-QJxU.crl, http://c.pki.goog/we1/OpMCQT6sVwg.crl, http://c.pki.goog/we1/OuqGbJkzwhU.crl, http://c.pki.goog/we1/PCUeQViQlYc.crl, http://c.pki.goog/we1/Pmn3y1aCZAo.crl, http://c.pki.goog/we1/QfwDhc9dNKY.crl, http://c.pki.goog/we1/QnuDYkUfA5s.crl, http://c.pki.goog/we1/QoqFz1z0bWA.crl, http://c.pki.goog/we1/R3uyA_0OtKA.crl, http://c.pki.goog/we1/R7LgAnKD4Lk.crl, http://c.pki.goog/we1/S5C6cZxkWsc.crl, http://c.pki.goog/we1/SXiTs4pnn2c.crl, http://c.pki.goog/we1/SaWLYV2xvlI.crl, http://c.pki.goog/we1/Sf6VE40mPgw.crl, http://c.pki.goog/we1/T0VkE8LAbR8.crl, http://c.pki.goog/we1/T58q3x0jyXI.crl, http://c.pki.goog/we1/TQRRitNQZa8.crl, http://c.pki.goog/we1/TZg9FK9zoSc.crl, http://c.pki.goog/we1/TgxXJzCQ3Ko.crl, http://c.pki.goog/we1/TtOTTrC8vRQ.crl, http://c.pki.goog/we1/U2k3Nbjapas.crl, http://c.pki.goog/we1/UIumR6EfnvM.crl, http://c.pki.goog/we1/UNvP7iUHXM0.crl, http://c.pki.goog/we1/USODfqcOxVM.crl, http://c.pki.goog/we1/Un79Lm4-K_s.crl, http://c.pki.goog/we1/V4D0AIkfl2I.crl, http://c.pki.goog/we1/Vb9kwdkpRtY.crl, http://c.pki.goog/we1/WCuuEb_Odnw.crl, http://c.pki.goog/we1/WyINKZSbmqk.crl, http://c.pki.goog/we1/X2M_FEd6Z7c.crl, http://c.pki.goog/we1/XWPkyQXvHmQ.crl, http://c.pki.goog/we1/Xw7k995BvVg.crl, http://c.pki.goog/we1/YH8nvPoZu_g.crl, http://c.pki.goog/we1/YLlS1L_ZkKk.crl, http://c.pki.goog/we1/Yh_eO4rxBDg.crl, http://c.pki.goog/we1/Yic14q9XRBo.crl, http://c.pki.goog/we1/YzYruHDXVK0.crl, http://c.pki.goog/we1/ZIovFvGuJMU.crl, http://c.pki.goog/we1/ZjcHv8Zi2GA.crl, http://c.pki.goog/we1/ZkjzUXKCUwU.crl, http://c.pki.goog/we1/_-4iFwfCacM.crl, http://c.pki.goog/we1/_6YJ-enHw1Y.crl, http://c.pki.goog/we1/_MYRZUBtxZI.crl, http://c.pki.goog/we1/_dxV1mTmoJc.crl, http://c.pki.goog/we1/_hiyWRttjyM.crl, http://c.pki.goog/we1/_xsEHlbXNIE.crl, http://c.pki.goog/we1/b4rrFg4gOhA.crl, http://c.pki.goog/we1/bCj6TXPeWec.crl, http://c.pki.goog/we1/bd2V6AJYUXg.crl, http://c.pki.goog/we1/btvd66Z9uQY.crl, http://c.pki.goog/we1/c9egY9ikPsU.crl, http://c.pki.goog/we1/cM76QZUXmE8.crl, http://c.pki.goog/we1/dpcZcgUNPbE.crl, http://c.pki.goog/we1/e19tNpFF5H4.crl, http://c.pki.goog/we1/f-LqBsO90gY.crl, http://c.pki.goog/we1/f3ewCkQVMyI.crl, http://c.pki.goog/we1/f9V0xSFiRKs.crl, http://c.pki.goog/we1/fFQtDcOPaQI.crl, http://c.pki.goog/we1/fJedmL2peto.crl, http://c.pki.goog/we1/fWa0w0sMqcA.crl, http://c.pki.goog/we1/g4x6SbHw2QQ.crl, http://c.pki.goog/we1/gxIBv6B2hYw.crl, http://c.pki.goog/we1/h_V5jn8i9Ks.crl, http://c.pki.goog/we1/hx34Vi4ORbM.crl, http://c.pki.goog/we1/hxWfeVec_R4.crl, http://c.pki.goog/we1/hyVOyYKxz9E.crl, http://c.pki.goog/we1/i4u_miZqw1E.crl, http://c.pki.goog/we1/iUnSZAxKPhw.crl, http://c.pki.goog/we1/ioCWfLly_Gg.crl, http://c.pki.goog/we1/j-6Pad2quEc.crl, http://c.pki.goog/we1/jJf4fCj886Y.crl, http://c.pki.goog/we1/jOS_4m-LORs.crl, http://c.pki.goog/we1/jQ595FtbPDk.crl, http://c.pki.goog/we1/jkIjDkDqFBc.crl, http://c.pki.goog/we1/k9D0LcQcFTo.crl, http://c.pki.goog/we1/kb6xWz-TctY.crl, http://c.pki.goog/we1/khE4z_g7LG8.crl, http://c.pki.goog/we1/lItwE7FHOOM.crl, http://c.pki.goog/we1/m4BkrTkPX5Y.crl, http://c.pki.goog/we1/m8zfv5rsnVE.crl, http://c.pki.goog/we1/mGnV4RWIzn0.crl, http://c.pki.goog/we1/mdHjcP3Bnqc.crl, http://c.pki.goog/we1/n0dx7V1Gbbo.crl, http://c.pki.goog/we1/nXrN9meVWok.crl, http://c.pki.goog/we1/o1fiiaEFTlk.crl, http://c.pki.goog/we1/p3h7Ul8wx3k.crl, http://c.pki.goog/we1/pIG1Fj9HZEw.crl, http://c.pki.goog/we1/pVHkAbbILwY.crl, http://c.pki.goog/we1/peDXaqF3Tp8.crl, http://c.pki.goog/we1/pl4XiTjSDSk.crl, http://c.pki.goog/we1/pnDlkWlcNeI.crl, http://c.pki.goog/we1/pyeoXlQPF4E.crl, http://c.pki.goog/we1/qXRwQ5LVWco.crl, http://c.pki.goog/we1/qon3-PAxUq8.crl, http://c.pki.goog/we1/r1Lq4vMcD8c.crl, http://c.pki.goog/we1/rdoZaP-CE4Y.crl, http://c.pki.goog/we1/rdt6OZTVTTg.crl, http://c.pki.goog/we1/rgeokRA_n-g.crl, http://c.pki.goog/we1/s77gqC02Wgo.crl, http://c.pki.goog/we1/t3LJbZiBtsU.crl, http://c.pki.goog/we1/t4Y_tS4oQ9A.crl, http://c.pki.goog/we1/t62Et4WE5QY.crl, http://c.pki.goog/we1/tVFs5tB-aco.crl, http://c.pki.goog/we1/tX2H5hSFwqE.crl, http://c.pki.goog/we1/tb8roZNrZ40.crl, http://c.pki.goog/we1/tqAYaqExRbM.crl, http://c.pki.goog/we1/ty82fqB0hAw.crl, http://c.pki.goog/we1/tygqm2Ip0_w.crl, http://c.pki.goog/we1/uCglcmwwftc.crl, http://c.pki.goog/we1/uIjxjnqAt90.crl, http://c.pki.goog/we1/uTOpeqvFBmY.crl, http://c.pki.goog/we1/v1q7FffOpC4.crl, http://c.pki.goog/we1/v7bAe0vWaYs.crl, http://c.pki.goog/we1/vRbdOFLardo.crl, http://c.pki.goog/we1/vUPS_N7Q7r0.crl, http://c.pki.goog/we1/vmjQnTcrfiY.crl, http://c.pki.goog/we1/vpMVCCR8pGU.crl, http://c.pki.goog/we1/xRzb4KCC9ig.crl, http://c.pki.goog/we1/x_tyL95aY0Q.crl, http://c.pki.goog/we1/xgUc4c2k3B4.crl, http://c.pki.goog/we1/xkS2PerK07g.crl, http://c.pki.goog/we1/xmLIiaFUWIY.crl, http://c.pki.goog/we1/ygWPENklvpM.crl, http://c.pki.goog/we1/yoggNsz3xQU.crl, http://c.pki.goog/we1/z1cGKjt-3q0.crl, http://c.pki.goog/we1/zl-I8PCWPFE.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:57:68:9b:c2:4e:30:2d:90:e1:8a:41:bd:0e:1f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                90:77:92:35:67:C4:FF:A8:CC:A9:E6:7B:D9:80:79:7B:CC:93:F9:38
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/gsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: A287FFAB762CC69A26D482037EDF701F653CE899025C62A7E5CB88BB9B419CBB
    SPKI SHA256: 908769E8D34477CC2CBA0632C88605B22D7294C0840F78596D247C645B1AFC0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/gsr4.crt
- CRL Distribution Points: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE2

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE2
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FF3577FF63C7CA37E0642F8C8B86290
- SHA-256: 54F8CA858BCC7591F28D8DC3772E9BC581717F3A23A288BFD405939C36208DE5
- SPKI SHA-256: BE1EFC292835472E0D6AA183575D30FDC4DBF551F7050519A0258D6BDDD6FC46
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we2/64OUIVzpZV4.crl, http://c.pki.goog/we2/Gt0Gl6QoGAU.crl, http://c.pki.goog/we2/dTM3-0hpWfE.crl, http://c.pki.goog/we2/xuzt3PU9F_w.crl, http://c.pki.goog/we2/yK5nPhtHKQs.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:57:7f:f6:3c:7c:a3:7e:06:42:f8:c8:b8:62:90
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                75:BE:C4:77:AE:89:F6:44:37:7D:CF:B1:68:1F:1D:1A:EB:DC:34:59
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/gsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 54F8CA858BCC7591F28D8DC3772E9BC581717F3A23A288BFD405939C36208DE5
    SPKI SHA256: BE1EFC292835472E0D6AA183575D30FDC4DBF551F7050519A0258D6BDDD6FC46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/gsr4.crt
- CRL Distribution Points: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE2

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 7FF32D6B409D15D5965B05873A7C72E0
- SHA-256: 9C3F2FD11C57D7C649AD5A0932C0F0D29756F6A0A1C74C43E1E89A62D64CD320
- SPKI SHA-256: BE1EFC292835472E0D6AA183575D30FDC4DBF551F7050519A0258D6BDDD6FC46
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we2/64OUIVzpZV4.crl, http://c.pki.goog/we2/Gt0Gl6QoGAU.crl, http://c.pki.goog/we2/dTM3-0hpWfE.crl, http://c.pki.goog/we2/xuzt3PU9F_w.crl, http://c.pki.goog/we2/yK5nPhtHKQs.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:2d:6b:40:9d:15:d5:96:5b:05:87:3a:7c:72:e0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                75:BE:C4:77:AE:89:F6:44:37:7D:CF:B1:68:1F:1D:1A:EB:DC:34:59
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9C3F2FD11C57D7C649AD5A0932C0F0D29756F6A0A1C74C43E1E89A62D64CD320
    SPKI SHA256: BE1EFC292835472E0D6AA183575D30FDC4DBF551F7050519A0258D6BDDD6FC46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r4.crt
- CRL Distribution Points: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE3

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 7FF32D6DBD5EDD54CA4E4B6795729143
- SHA-256: 9F819A4C876E12DC84E6FE0E37C1A69B137094B453FA98449398F4B71F4D0092
- SPKI SHA-256: 75A04802729D4485F76EA33CE48E967BBC01521D033F270D14132F6245C65F64
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we3/-2tCjIK2Qi4.crl, http://c.pki.goog/we3/04rprveC1nM.crl, http://c.pki.goog/we3/0Vl-eAGiuEo.crl, http://c.pki.goog/we3/0zqVv11tnDo.crl, http://c.pki.goog/we3/17OlCI9X9ZU.crl, http://c.pki.goog/we3/18C46Sw09CM.crl, http://c.pki.goog/we3/1tMbKaSDpBE.crl, http://c.pki.goog/we3/2i847r2rEAM.crl, http://c.pki.goog/we3/2mgHZJ8FUNM.crl, http://c.pki.goog/we3/2oO9oawWfqE.crl, http://c.pki.goog/we3/2sH0RsEJi6M.crl, http://c.pki.goog/we3/2w39L5_NiFo.crl, http://c.pki.goog/we3/300Tltjjx04.crl, http://c.pki.goog/we3/36t1fgb34fY.crl, http://c.pki.goog/we3/3cdaAJJ7iss.crl, http://c.pki.goog/we3/3ezhQiQgcj0.crl, http://c.pki.goog/we3/4-ah2rSsRHI.crl, http://c.pki.goog/we3/4erpxBeWmns.crl, http://c.pki.goog/we3/4utoAwr96yY.crl, http://c.pki.goog/we3/5UfWn-QGEuA.crl, http://c.pki.goog/we3/5ZuFpRHiPSw.crl, http://c.pki.goog/we3/5a5UhuHwzPs.crl, http://c.pki.goog/we3/5y-hNICrrc4.crl, http://c.pki.goog/we3/6BuO9_jdXCI.crl, http://c.pki.goog/we3/7BPVAZCR9YA.crl, http://c.pki.goog/we3/7odQG8K9bvI.crl, http://c.pki.goog/we3/8MXdlvH0uyY.crl, http://c.pki.goog/we3/8NUVdjd2j78.crl, http://c.pki.goog/we3/8XH4mau3qKo.crl, http://c.pki.goog/we3/8fZ0MyF9C9s.crl, http://c.pki.goog/we3/9bpvZTZywVc.crl, http://c.pki.goog/we3/9w12Gv2Yve0.crl, http://c.pki.goog/we3/9z5eKhk0_lE.crl, http://c.pki.goog/we3/AM57YlbQ8QA.crl, http://c.pki.goog/we3/AYdp9NNR5dA.crl, http://c.pki.goog/we3/AdDYrOQZ700.crl, http://c.pki.goog/we3/B2h6cO6HHxg.crl, http://c.pki.goog/we3/B9GzXR6SnTA.crl, http://c.pki.goog/we3/BPxfv4lYb2U.crl, http://c.pki.goog/we3/Bb7mQ4UBZJI.crl, http://c.pki.goog/we3/BebTSfHbCrk.crl, http://c.pki.goog/we3/Bx0WYoO9C7U.crl, http://c.pki.goog/we3/C1wrvIM6v3w.crl, http://c.pki.goog/we3/CAhxmn8HQOI.crl, http://c.pki.goog/we3/CCfR3kqiijM.crl, http://c.pki.goog/we3/D94WDhMJh5E.crl, http://c.pki.goog/we3/DLhC4xAcIRQ.crl, http://c.pki.goog/we3/Db8Ob0VncwM.crl, http://c.pki.goog/we3/EFKq9H7G9-Q.crl, http://c.pki.goog/we3/EGv4dwlcjos.crl, http://c.pki.goog/we3/EXUZaITu-Cw.crl, http://c.pki.goog/we3/Ei7pZruyZoc.crl, http://c.pki.goog/we3/F-5-3HFdBz4.crl, http://c.pki.goog/we3/FGFEQ8aWL1c.crl, http://c.pki.goog/we3/G-sNaqk75Ec.crl, http://c.pki.goog/we3/GOOF9jujyJ8.crl, http://c.pki.goog/we3/Gds-31CifV4.crl, http://c.pki.goog/we3/GnmvEwg8qec.crl, http://c.pki.goog/we3/H2lJbYKxrQo.crl, http://c.pki.goog/we3/H4TGwGaZr74.crl, http://c.pki.goog/we3/HEDp1m_c9aY.crl, http://c.pki.goog/we3/HK4aI5YXKhM.crl, http://c.pki.goog/we3/HYm3RuD3B1c.crl, http://c.pki.goog/we3/IMj5QTJmlsE.crl, http://c.pki.goog/we3/J1o790WvqWk.crl, http://c.pki.goog/we3/JRJSFJylgzA.crl, http://c.pki.goog/we3/JWmB6zNQsxw.crl, http://c.pki.goog/we3/Jac0pMT_TzE.crl, http://c.pki.goog/we3/JxCYwigvHQk.crl, http://c.pki.goog/we3/K857yj-fjPI.crl, http://c.pki.goog/we3/KOKGG2EDPlc.crl, http://c.pki.goog/we3/Ke7BNhlBU-k.crl, http://c.pki.goog/we3/L0o8J3udPRU.crl, http://c.pki.goog/we3/L6EMjlvcMhU.crl, http://c.pki.goog/we3/Li2ZAeNe1CA.crl, http://c.pki.goog/we3/Lxl_T-ExTus.crl, http://c.pki.goog/we3/MJbvfuOZyFI.crl, http://c.pki.goog/we3/MkEsLlqF28w.crl, http://c.pki.goog/we3/MyOAyrR4xmI.crl, http://c.pki.goog/we3/NI7hyqKS5Ho.crl, http://c.pki.goog/we3/O6RPHvEhzBg.crl, http://c.pki.goog/we3/O7YfJAH_dT0.crl, http://c.pki.goog/we3/OOpeBgci6aA.crl, http://c.pki.goog/we3/Ob8Uv5mY0RQ.crl, http://c.pki.goog/we3/Ox1oCe3HIaE.crl, http://c.pki.goog/we3/OzlK-doNZ7I.crl, http://c.pki.goog/we3/PJM_v00dnAg.crl, http://c.pki.goog/we3/PY_eNwNfhN0.crl, http://c.pki.goog/we3/P_atNBjWEIA.crl, http://c.pki.goog/we3/Q0rcQdyAnhE.crl, http://c.pki.goog/we3/QSjjNJ7rL10.crl, http://c.pki.goog/we3/QuiaZHIsoPQ.crl, http://c.pki.goog/we3/RNaNMiOLDdQ.crl, http://c.pki.goog/we3/RuuXmjse4OI.crl, http://c.pki.goog/we3/TSSQafTX6Vg.crl, http://c.pki.goog/we3/TVkcG83YCeo.crl, http://c.pki.goog/we3/U9HvVFcqSx0.crl, http://c.pki.goog/we3/UQC2SoRIRcM.crl, http://c.pki.goog/we3/UsJ70mRHiak.crl, http://c.pki.goog/we3/UsRdexcEcdA.crl, http://c.pki.goog/we3/V64I3G30l6A.crl, http://c.pki.goog/we3/VpV9emxnhK8.crl, http://c.pki.goog/we3/W0gGVdo8Gow.crl, http://c.pki.goog/we3/W8RChrlVdic.crl, http://c.pki.goog/we3/WoIPnTyUQwo.crl, http://c.pki.goog/we3/WqewKGCcZXI.crl, http://c.pki.goog/we3/X7MhvgWqbDE.crl, http://c.pki.goog/we3/XG3CxgeY8cU.crl, http://c.pki.goog/we3/XP1xuWJYpnY.crl, http://c.pki.goog/we3/XWkweBrv_k4.crl, http://c.pki.goog/we3/Xpi0tstwwWM.crl, http://c.pki.goog/we3/XyTd4_HLqJo.crl, http://c.pki.goog/we3/YEerBTYLgs0.crl, http://c.pki.goog/we3/YLqxOle9wrM.crl, http://c.pki.goog/we3/Yw0Z4kW7cw0.crl, http://c.pki.goog/we3/YzTpjwIM0FA.crl, http://c.pki.goog/we3/_lsq1_JfSIY.crl, http://c.pki.goog/we3/a8Sv_t3ykOo.crl, http://c.pki.goog/we3/aR40f6bgkAs.crl, http://c.pki.goog/we3/bE8eJSmqY7U.crl, http://c.pki.goog/we3/b_Yd5HGvRoU.crl, http://c.pki.goog/we3/brYM2A7acgI.crl, http://c.pki.goog/we3/bzHfJHa2p9M.crl, http://c.pki.goog/we3/c0UtgH51Pp8.crl, http://c.pki.goog/we3/c2YuBudIPm0.crl, http://c.pki.goog/we3/cgST9lFwl38.crl, http://c.pki.goog/we3/crpcGjZt5ds.crl, http://c.pki.goog/we3/dLlqW7nDy3Q.crl, http://c.pki.goog/we3/dvRFW4WAuIk.crl, http://c.pki.goog/we3/dx3wbec1aF4.crl, http://c.pki.goog/we3/e4KuI2tMyD0.crl, http://c.pki.goog/we3/ec2y3XMwqDI.crl, http://c.pki.goog/we3/exIsp0yjhU8.crl, http://c.pki.goog/we3/f5yRtYSR7pc.crl, http://c.pki.goog/we3/fD_N_bAjvYI.crl, http://c.pki.goog/we3/fIDaz7q0Raw.crl, http://c.pki.goog/we3/fUTFoTFmMwo.crl, http://c.pki.goog/we3/fzkt7tzokrY.crl, http://c.pki.goog/we3/gdVV7w3kG14.crl, http://c.pki.goog/we3/gkNyAMl09jg.crl, http://c.pki.goog/we3/hkhLb8QrrKM.crl, http://c.pki.goog/we3/hlmvjzVg6Vc.crl, http://c.pki.goog/we3/ieQWb0IPiJ4.crl, http://c.pki.goog/we3/ixjQWZqXXhE.crl, http://c.pki.goog/we3/j87y6GYlmcU.crl, http://c.pki.goog/we3/k50NXbQUKwE.crl, http://c.pki.goog/we3/k6ZI5ncrz9k.crl, http://c.pki.goog/we3/kPHkekIhzYU.crl, http://c.pki.goog/we3/ksqoX-fGoFE.crl, http://c.pki.goog/we3/ku37x_mdLA0.crl, http://c.pki.goog/we3/lC2zdYXpxNs.crl, http://c.pki.goog/we3/l_IINCpmNd4.crl, http://c.pki.goog/we3/lfS7Mz-9uog.crl, http://c.pki.goog/we3/lgCMVvs7Ngs.crl, http://c.pki.goog/we3/lvotYEzYWbo.crl, http://c.pki.goog/we3/mAiKfS-tf74.crl, http://c.pki.goog/we3/m_8qfsZk9RE.crl, http://c.pki.goog/we3/mx517JExuOo.crl, http://c.pki.goog/we3/nCEzX90xz0s.crl, http://c.pki.goog/we3/nbWHpZ_nYUA.crl, http://c.pki.goog/we3/nnuagEFYvu0.crl, http://c.pki.goog/we3/nsgNeiKoSyI.crl, http://c.pki.goog/we3/oA5h0MGN0OE.crl, http://c.pki.goog/we3/oF0vc4S1po0.crl, http://c.pki.goog/we3/ovmBxICiXfI.crl, http://c.pki.goog/we3/pBHOefhm8ek.crl, http://c.pki.goog/we3/piTKyeKc4TU.crl, http://c.pki.goog/we3/qPDWVO_sMYs.crl, http://c.pki.goog/we3/rAh2cLfBfWQ.crl, http://c.pki.goog/we3/rHCQHgtihSw.crl, http://c.pki.goog/we3/rXrQXG9IZI0.crl, http://c.pki.goog/we3/r_JS8yR93_k.crl, http://c.pki.goog/we3/rybDQAjrDsM.crl, http://c.pki.goog/we3/s8LYIfydnu8.crl, http://c.pki.goog/we3/s9eOePBepAY.crl, http://c.pki.goog/we3/sSJ0B5HDNw8.crl, http://c.pki.goog/we3/sd9cUj-zXcY.crl, http://c.pki.goog/we3/stid93L8XNo.crl, http://c.pki.goog/we3/t9nfudrsmlU.crl, http://c.pki.goog/we3/tB4IfYQlnnc.crl, http://c.pki.goog/we3/tGKNxMlxwjg.crl, http://c.pki.goog/we3/tOqVhNPsLTk.crl, http://c.pki.goog/we3/tR5xjNu5gWg.crl, http://c.pki.goog/we3/ugMiHW6M5TQ.crl, http://c.pki.goog/we3/v7iOc8cznJk.crl, http://c.pki.goog/we3/vcuT5WgnS3w.crl, http://c.pki.goog/we3/vkewGjlDImg.crl, http://c.pki.goog/we3/vt5gw1urngk.crl, http://c.pki.goog/we3/vxSnfLMeEcs.crl, http://c.pki.goog/we3/wAkABt_zZIQ.crl, http://c.pki.goog/we3/wuNMn44QeDA.crl, http://c.pki.goog/we3/x-263OuGky8.crl, http://c.pki.goog/we3/x5aI2FsAKfI.crl, http://c.pki.goog/we3/xw8IXeJHT-s.crl, http://c.pki.goog/we3/yHyFOGWINco.crl, http://c.pki.goog/we3/yjYUjnLAWj8.crl, http://c.pki.goog/we3/z5i8UFVOtfg.crl, http://c.pki.goog/we3/z6VT0Z81sNA.crl, http://c.pki.goog/we3/zZZCdmJ4Vak.crl, http://c.pki.goog/we3/zmA-gnEf22w.crl, http://c.pki.goog/we3/zzUgMJXITzE.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:2d:6d:bd:5e:dd:54:ca:4e:4b:67:95:72:91:43
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                36:B6:2C:CE:A3:B4:D0:40:90:45:F3:8B:45:81:C1:C8:E3:19:D4:6D
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9F819A4C876E12DC84E6FE0E37C1A69B137094B453FA98449398F4B71F4D0092
    SPKI SHA256: 75A04802729D4485F76EA33CE48E967BBC01521D033F270D14132F6245C65F64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r4.crt
- CRL Distribution Points: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE3

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE3
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FF357910F07E1929F3D0084AEF198C7
- SHA-256: 54C660DA29D75FC81F07AD6DC8BB7AEE2258E071E8B1077544FA5622FF44C99D
- SPKI SHA-256: 75A04802729D4485F76EA33CE48E967BBC01521D033F270D14132F6245C65F64
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we3/-2tCjIK2Qi4.crl, http://c.pki.goog/we3/04rprveC1nM.crl, http://c.pki.goog/we3/0Vl-eAGiuEo.crl, http://c.pki.goog/we3/0zqVv11tnDo.crl, http://c.pki.goog/we3/17OlCI9X9ZU.crl, http://c.pki.goog/we3/18C46Sw09CM.crl, http://c.pki.goog/we3/1tMbKaSDpBE.crl, http://c.pki.goog/we3/2i847r2rEAM.crl, http://c.pki.goog/we3/2mgHZJ8FUNM.crl, http://c.pki.goog/we3/2oO9oawWfqE.crl, http://c.pki.goog/we3/2sH0RsEJi6M.crl, http://c.pki.goog/we3/2w39L5_NiFo.crl, http://c.pki.goog/we3/300Tltjjx04.crl, http://c.pki.goog/we3/36t1fgb34fY.crl, http://c.pki.goog/we3/3cdaAJJ7iss.crl, http://c.pki.goog/we3/3ezhQiQgcj0.crl, http://c.pki.goog/we3/4-ah2rSsRHI.crl, http://c.pki.goog/we3/4erpxBeWmns.crl, http://c.pki.goog/we3/4utoAwr96yY.crl, http://c.pki.goog/we3/5UfWn-QGEuA.crl, http://c.pki.goog/we3/5ZuFpRHiPSw.crl, http://c.pki.goog/we3/5a5UhuHwzPs.crl, http://c.pki.goog/we3/5y-hNICrrc4.crl, http://c.pki.goog/we3/6BuO9_jdXCI.crl, http://c.pki.goog/we3/7BPVAZCR9YA.crl, http://c.pki.goog/we3/7odQG8K9bvI.crl, http://c.pki.goog/we3/8MXdlvH0uyY.crl, http://c.pki.goog/we3/8NUVdjd2j78.crl, http://c.pki.goog/we3/8XH4mau3qKo.crl, http://c.pki.goog/we3/8fZ0MyF9C9s.crl, http://c.pki.goog/we3/9bpvZTZywVc.crl, http://c.pki.goog/we3/9w12Gv2Yve0.crl, http://c.pki.goog/we3/9z5eKhk0_lE.crl, http://c.pki.goog/we3/AM57YlbQ8QA.crl, http://c.pki.goog/we3/AYdp9NNR5dA.crl, http://c.pki.goog/we3/AdDYrOQZ700.crl, http://c.pki.goog/we3/B2h6cO6HHxg.crl, http://c.pki.goog/we3/B9GzXR6SnTA.crl, http://c.pki.goog/we3/BPxfv4lYb2U.crl, http://c.pki.goog/we3/Bb7mQ4UBZJI.crl, http://c.pki.goog/we3/BebTSfHbCrk.crl, http://c.pki.goog/we3/Bx0WYoO9C7U.crl, http://c.pki.goog/we3/C1wrvIM6v3w.crl, http://c.pki.goog/we3/CAhxmn8HQOI.crl, http://c.pki.goog/we3/CCfR3kqiijM.crl, http://c.pki.goog/we3/D94WDhMJh5E.crl, http://c.pki.goog/we3/DLhC4xAcIRQ.crl, http://c.pki.goog/we3/Db8Ob0VncwM.crl, http://c.pki.goog/we3/EFKq9H7G9-Q.crl, http://c.pki.goog/we3/EGv4dwlcjos.crl, http://c.pki.goog/we3/EXUZaITu-Cw.crl, http://c.pki.goog/we3/Ei7pZruyZoc.crl, http://c.pki.goog/we3/F-5-3HFdBz4.crl, http://c.pki.goog/we3/FGFEQ8aWL1c.crl, http://c.pki.goog/we3/G-sNaqk75Ec.crl, http://c.pki.goog/we3/GOOF9jujyJ8.crl, http://c.pki.goog/we3/Gds-31CifV4.crl, http://c.pki.goog/we3/GnmvEwg8qec.crl, http://c.pki.goog/we3/H2lJbYKxrQo.crl, http://c.pki.goog/we3/H4TGwGaZr74.crl, http://c.pki.goog/we3/HEDp1m_c9aY.crl, http://c.pki.goog/we3/HK4aI5YXKhM.crl, http://c.pki.goog/we3/HYm3RuD3B1c.crl, http://c.pki.goog/we3/IMj5QTJmlsE.crl, http://c.pki.goog/we3/J1o790WvqWk.crl, http://c.pki.goog/we3/JRJSFJylgzA.crl, http://c.pki.goog/we3/JWmB6zNQsxw.crl, http://c.pki.goog/we3/Jac0pMT_TzE.crl, http://c.pki.goog/we3/JxCYwigvHQk.crl, http://c.pki.goog/we3/K857yj-fjPI.crl, http://c.pki.goog/we3/KOKGG2EDPlc.crl, http://c.pki.goog/we3/Ke7BNhlBU-k.crl, http://c.pki.goog/we3/L0o8J3udPRU.crl, http://c.pki.goog/we3/L6EMjlvcMhU.crl, http://c.pki.goog/we3/Li2ZAeNe1CA.crl, http://c.pki.goog/we3/Lxl_T-ExTus.crl, http://c.pki.goog/we3/MJbvfuOZyFI.crl, http://c.pki.goog/we3/MkEsLlqF28w.crl, http://c.pki.goog/we3/MyOAyrR4xmI.crl, http://c.pki.goog/we3/NI7hyqKS5Ho.crl, http://c.pki.goog/we3/O6RPHvEhzBg.crl, http://c.pki.goog/we3/O7YfJAH_dT0.crl, http://c.pki.goog/we3/OOpeBgci6aA.crl, http://c.pki.goog/we3/Ob8Uv5mY0RQ.crl, http://c.pki.goog/we3/Ox1oCe3HIaE.crl, http://c.pki.goog/we3/OzlK-doNZ7I.crl, http://c.pki.goog/we3/PJM_v00dnAg.crl, http://c.pki.goog/we3/PY_eNwNfhN0.crl, http://c.pki.goog/we3/P_atNBjWEIA.crl, http://c.pki.goog/we3/Q0rcQdyAnhE.crl, http://c.pki.goog/we3/QSjjNJ7rL10.crl, http://c.pki.goog/we3/QuiaZHIsoPQ.crl, http://c.pki.goog/we3/RNaNMiOLDdQ.crl, http://c.pki.goog/we3/RuuXmjse4OI.crl, http://c.pki.goog/we3/TSSQafTX6Vg.crl, http://c.pki.goog/we3/TVkcG83YCeo.crl, http://c.pki.goog/we3/U9HvVFcqSx0.crl, http://c.pki.goog/we3/UQC2SoRIRcM.crl, http://c.pki.goog/we3/UsJ70mRHiak.crl, http://c.pki.goog/we3/UsRdexcEcdA.crl, http://c.pki.goog/we3/V64I3G30l6A.crl, http://c.pki.goog/we3/VpV9emxnhK8.crl, http://c.pki.goog/we3/W0gGVdo8Gow.crl, http://c.pki.goog/we3/W8RChrlVdic.crl, http://c.pki.goog/we3/WoIPnTyUQwo.crl, http://c.pki.goog/we3/WqewKGCcZXI.crl, http://c.pki.goog/we3/X7MhvgWqbDE.crl, http://c.pki.goog/we3/XG3CxgeY8cU.crl, http://c.pki.goog/we3/XP1xuWJYpnY.crl, http://c.pki.goog/we3/XWkweBrv_k4.crl, http://c.pki.goog/we3/Xpi0tstwwWM.crl, http://c.pki.goog/we3/XyTd4_HLqJo.crl, http://c.pki.goog/we3/YEerBTYLgs0.crl, http://c.pki.goog/we3/YLqxOle9wrM.crl, http://c.pki.goog/we3/Yw0Z4kW7cw0.crl, http://c.pki.goog/we3/YzTpjwIM0FA.crl, http://c.pki.goog/we3/_lsq1_JfSIY.crl, http://c.pki.goog/we3/a8Sv_t3ykOo.crl, http://c.pki.goog/we3/aR40f6bgkAs.crl, http://c.pki.goog/we3/bE8eJSmqY7U.crl, http://c.pki.goog/we3/b_Yd5HGvRoU.crl, http://c.pki.goog/we3/brYM2A7acgI.crl, http://c.pki.goog/we3/bzHfJHa2p9M.crl, http://c.pki.goog/we3/c0UtgH51Pp8.crl, http://c.pki.goog/we3/c2YuBudIPm0.crl, http://c.pki.goog/we3/cgST9lFwl38.crl, http://c.pki.goog/we3/crpcGjZt5ds.crl, http://c.pki.goog/we3/dLlqW7nDy3Q.crl, http://c.pki.goog/we3/dvRFW4WAuIk.crl, http://c.pki.goog/we3/dx3wbec1aF4.crl, http://c.pki.goog/we3/e4KuI2tMyD0.crl, http://c.pki.goog/we3/ec2y3XMwqDI.crl, http://c.pki.goog/we3/exIsp0yjhU8.crl, http://c.pki.goog/we3/f5yRtYSR7pc.crl, http://c.pki.goog/we3/fD_N_bAjvYI.crl, http://c.pki.goog/we3/fIDaz7q0Raw.crl, http://c.pki.goog/we3/fUTFoTFmMwo.crl, http://c.pki.goog/we3/fzkt7tzokrY.crl, http://c.pki.goog/we3/gdVV7w3kG14.crl, http://c.pki.goog/we3/gkNyAMl09jg.crl, http://c.pki.goog/we3/hkhLb8QrrKM.crl, http://c.pki.goog/we3/hlmvjzVg6Vc.crl, http://c.pki.goog/we3/ieQWb0IPiJ4.crl, http://c.pki.goog/we3/ixjQWZqXXhE.crl, http://c.pki.goog/we3/j87y6GYlmcU.crl, http://c.pki.goog/we3/k50NXbQUKwE.crl, http://c.pki.goog/we3/k6ZI5ncrz9k.crl, http://c.pki.goog/we3/kPHkekIhzYU.crl, http://c.pki.goog/we3/ksqoX-fGoFE.crl, http://c.pki.goog/we3/ku37x_mdLA0.crl, http://c.pki.goog/we3/lC2zdYXpxNs.crl, http://c.pki.goog/we3/l_IINCpmNd4.crl, http://c.pki.goog/we3/lfS7Mz-9uog.crl, http://c.pki.goog/we3/lgCMVvs7Ngs.crl, http://c.pki.goog/we3/lvotYEzYWbo.crl, http://c.pki.goog/we3/mAiKfS-tf74.crl, http://c.pki.goog/we3/m_8qfsZk9RE.crl, http://c.pki.goog/we3/mx517JExuOo.crl, http://c.pki.goog/we3/nCEzX90xz0s.crl, http://c.pki.goog/we3/nbWHpZ_nYUA.crl, http://c.pki.goog/we3/nnuagEFYvu0.crl, http://c.pki.goog/we3/nsgNeiKoSyI.crl, http://c.pki.goog/we3/oA5h0MGN0OE.crl, http://c.pki.goog/we3/oF0vc4S1po0.crl, http://c.pki.goog/we3/ovmBxICiXfI.crl, http://c.pki.goog/we3/pBHOefhm8ek.crl, http://c.pki.goog/we3/piTKyeKc4TU.crl, http://c.pki.goog/we3/qPDWVO_sMYs.crl, http://c.pki.goog/we3/rAh2cLfBfWQ.crl, http://c.pki.goog/we3/rHCQHgtihSw.crl, http://c.pki.goog/we3/rXrQXG9IZI0.crl, http://c.pki.goog/we3/r_JS8yR93_k.crl, http://c.pki.goog/we3/rybDQAjrDsM.crl, http://c.pki.goog/we3/s8LYIfydnu8.crl, http://c.pki.goog/we3/s9eOePBepAY.crl, http://c.pki.goog/we3/sSJ0B5HDNw8.crl, http://c.pki.goog/we3/sd9cUj-zXcY.crl, http://c.pki.goog/we3/stid93L8XNo.crl, http://c.pki.goog/we3/t9nfudrsmlU.crl, http://c.pki.goog/we3/tB4IfYQlnnc.crl, http://c.pki.goog/we3/tGKNxMlxwjg.crl, http://c.pki.goog/we3/tOqVhNPsLTk.crl, http://c.pki.goog/we3/tR5xjNu5gWg.crl, http://c.pki.goog/we3/ugMiHW6M5TQ.crl, http://c.pki.goog/we3/v7iOc8cznJk.crl, http://c.pki.goog/we3/vcuT5WgnS3w.crl, http://c.pki.goog/we3/vkewGjlDImg.crl, http://c.pki.goog/we3/vt5gw1urngk.crl, http://c.pki.goog/we3/vxSnfLMeEcs.crl, http://c.pki.goog/we3/wAkABt_zZIQ.crl, http://c.pki.goog/we3/wuNMn44QeDA.crl, http://c.pki.goog/we3/x-263OuGky8.crl, http://c.pki.goog/we3/x5aI2FsAKfI.crl, http://c.pki.goog/we3/xw8IXeJHT-s.crl, http://c.pki.goog/we3/yHyFOGWINco.crl, http://c.pki.goog/we3/yjYUjnLAWj8.crl, http://c.pki.goog/we3/z5i8UFVOtfg.crl, http://c.pki.goog/we3/z6VT0Z81sNA.crl, http://c.pki.goog/we3/zZZCdmJ4Vak.crl, http://c.pki.goog/we3/zmA-gnEf22w.crl, http://c.pki.goog/we3/zzUgMJXITzE.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:57:91:0f:07:e1:92:9f:3d:00:84:ae:f1:98:c7
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                36:B6:2C:CE:A3:B4:D0:40:90:45:F3:8B:45:81:C1:C8:E3:19:D4:6D
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/gsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 54C660DA29D75FC81F07AD6DC8BB7AEE2258E071E8B1077544FA5622FF44C99D
    SPKI SHA256: 75A04802729D4485F76EA33CE48E967BBC01521D033F270D14132F6245C65F64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/gsr4.crt
- CRL Distribution Points: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE4

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE4
- Issuer: organizationalUnitName=GlobalSign ECC Root CA - R4, organizationName=GlobalSign, commonName=GlobalSign
- Serial: 7FF357A2DCFA8935B32362F61523B3A7
- SHA-256: 9D5E86906A1680A86BE278CF76E3D2B62B775186101461D303CEE910D94CE13A
- SPKI SHA-256: 3B94D00C1FF06B84A446306B40BD80ABD086DF5EC7F4C0C38294D572BA490DAE
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we4/-9kLEQiPvzs.crl, http://c.pki.goog/we4/8WXh8EtfqKo.crl, http://c.pki.goog/we4/BbjBJUXQlJw.crl, http://c.pki.goog/we4/Bcuu3uTv9M8.crl, http://c.pki.goog/we4/CfPbsNKHUcg.crl, http://c.pki.goog/we4/TGj2UynYNZM.crl, http://c.pki.goog/we4/_XITJ0NUWGg.crl, http://c.pki.goog/we4/ahIfPZ5d-zc.crl, http://c.pki.goog/we4/eti3zx0hRKM.crl, http://c.pki.goog/we4/gefghN0FUx0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:57:a2:dc:fa:89:35:b3:23:62:f6:15:23:b3:a7
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6D:E7:D4:65:B4:38:57:56:95:CD:E5:B4:77:5A:36:0A:DE:7D:52:A6
            X509v3 Authority Key Identifier:
                54:B0:7B:AD:45:B8:E2:40:7F:FB:0A:6E:FB:BE:33:C9:3C:A3:84:D5
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/gsr4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/gsr4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 9D5E86906A1680A86BE278CF76E3D2B62B775186101461D303CEE910D94CE13A
    SPKI SHA256: 3B94D00C1FF06B84A446306B40BD80ABD086DF5EC7F4C0C38294D572BA490DAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/gsr4.crt
- CRL Distribution Points: http://c.pki.goog/r/gsr4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE4

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R4
- Serial: 7FF32D70BBD1A7309B5732500AC99AAE
- SHA-256: D0C97E56C7B0BA812D944AD771F7799B5D4144A2327A4E416554F7EE2AA0AEAE
- SPKI SHA-256: 3B94D00C1FF06B84A446306B40BD80ABD086DF5EC7F4C0C38294D572BA490DAE
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we4/-9kLEQiPvzs.crl, http://c.pki.goog/we4/8WXh8EtfqKo.crl, http://c.pki.goog/we4/BbjBJUXQlJw.crl, http://c.pki.goog/we4/Bcuu3uTv9M8.crl, http://c.pki.goog/we4/CfPbsNKHUcg.crl, http://c.pki.goog/we4/TGj2UynYNZM.crl, http://c.pki.goog/we4/_XITJ0NUWGg.crl, http://c.pki.goog/we4/ahIfPZ5d-zc.crl, http://c.pki.goog/we4/eti3zx0hRKM.crl, http://c.pki.goog/we4/gefghN0FUx0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f3:2d:70:bb:d1:a7:30:9b:57:32:50:0a:c9:9a:ae
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6D:E7:D4:65:B4:38:57:56:95:CD:E5:B4:77:5A:36:0A:DE:7D:52:A6
            X509v3 Authority Key Identifier:
                80:4C:D6:EB:74:FF:49:36:A3:D5:D8:FC:B5:3E:C5:6A:F0:94:1D:8C
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r4.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D0C97E56C7B0BA812D944AD771F7799B5D4144A2327A4E416554F7EE2AA0AEAE
    SPKI SHA256: 3B94D00C1FF06B84A446306B40BD80ABD086DF5EC7F4C0C38294D572BA490DAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r4.crt
- CRL Distribution Points: http://c.pki.goog/r/r4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WE5

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WE5
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R3
- Serial: 7FF4E5CBECD981F2ADFA08913CEFAB14
- SHA-256: 847409E63526F162753AC49F75218EFAAFA7D5C94ADE9095CE72E7F6B6E3AC99
- SPKI SHA-256: F326712E0A51F046CEF00351AD6280CC8CF3F5776549482D60F9172985251926
- Validity: 2023-12-13 to 2029-02-20
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/we5/yUki06p-2wI.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f4:e5:cb:ec:d9:81:f2:ad:fa:08:91:3c:ef:ab:14
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WE5
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D4:65:CB:38:C7:25:3C:28:6B:E9:7E:43:C3:A1:A1:B8:E4:4C:68:A0
            X509v3 Authority Key Identifier:
                C1:F1:26:BA:A0:2D:AE:85:81:CF:D3:F1:2A:12:BD:B8:0A:67:FD:BC
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 847409E63526F162753AC49F75218EFAAFA7D5C94ADE9095CE72E7F6B6E3AC99
    SPKI SHA256: F326712E0A51F046CEF00351AD6280CC8CF3F5776549482D60F9172985251926
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r3.crt
- CRL Distribution Points: http://c.pki.goog/r/r3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WR1

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WR1
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 7FD9E2C2D2048A0474B627A26D0868A7
- SHA-256: B10B6F00E609509E8700F6D34687A2BFCE38EA05A8FDF1CDC40C3A2A0D0D0E45
- SPKI SHA-256: C83BBDA20DB9E4D3791847FE0706BDAD3AEA150D04C9D674AF514287D4DD016E
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/wr1/-3Q8Lxr4swY.crl, http://c.pki.goog/wr1/-4CjnBIfzTs.crl, http://c.pki.goog/wr1/-Hb8SlKXoH8.crl, http://c.pki.goog/wr1/02vhu2ZqoBw.crl, http://c.pki.goog/wr1/0zrmRi9UvWk.crl, http://c.pki.goog/wr1/1IpaVurLY24.crl, http://c.pki.goog/wr1/2BHK0Kt6Ac8.crl, http://c.pki.goog/wr1/31CMUeMaYGI.crl, http://c.pki.goog/wr1/3CQTlKS_pyo.crl, http://c.pki.goog/wr1/4428C414444.crl, http://c.pki.goog/wr1/47iRaVBm1zY.crl, http://c.pki.goog/wr1/4T-5Dpcms-k.crl, http://c.pki.goog/wr1/52rev-FX4Y4.crl, http://c.pki.goog/wr1/547j-NzNqYY.crl, http://c.pki.goog/wr1/63ZZYoZH0g4.crl, http://c.pki.goog/wr1/64cgrqpdQXE.crl, http://c.pki.goog/wr1/6As9hltjmbY.crl, http://c.pki.goog/wr1/6CDQoEZF2Bc.crl, http://c.pki.goog/wr1/6GAhImdYG8I.crl, http://c.pki.goog/wr1/6RWzjig1e90.crl, http://c.pki.goog/wr1/6YEUA4QKsMo.crl, http://c.pki.goog/wr1/6cDD7h3PHHY.crl, http://c.pki.goog/wr1/6m7ViZ3BT5A.crl, http://c.pki.goog/wr1/6myGLIVyncg.crl, http://c.pki.goog/wr1/74NOXVJ_oCo.crl, http://c.pki.goog/wr1/7AItB636UoU.crl, http://c.pki.goog/wr1/7zqA3apdxW0.crl, http://c.pki.goog/wr1/8Ha0MPKugYY.crl, http://c.pki.goog/wr1/8T_zeY2axgM.crl, http://c.pki.goog/wr1/8bQRlmvtmt8.crl, http://c.pki.goog/wr1/8fMWm3zu6hc.crl, http://c.pki.goog/wr1/96huBSG30d0.crl, http://c.pki.goog/wr1/A6c2DONp908.crl, http://c.pki.goog/wr1/AJWE5X2BWuE.crl, http://c.pki.goog/wr1/Ap04vJ05CyA.crl, http://c.pki.goog/wr1/B0cEU2bYubQ.crl, http://c.pki.goog/wr1/B9cxXyw8AVc.crl, http://c.pki.goog/wr1/Bcz6CqLTj1Y.crl, http://c.pki.goog/wr1/BnEENVT4R8w.crl, http://c.pki.goog/wr1/C0pifpLKzEA.crl, http://c.pki.goog/wr1/CO_pgzcCcJw.crl, http://c.pki.goog/wr1/CYmJxfg5t_8.crl, http://c.pki.goog/wr1/Cj_AnkL3zwk.crl, http://c.pki.goog/wr1/Cm-tKme1EOI.crl, http://c.pki.goog/wr1/DyLKiZCw3GI.crl, http://c.pki.goog/wr1/Ec-jHrFsuJY.crl, http://c.pki.goog/wr1/FHdyU9g-TUU.crl, http://c.pki.goog/wr1/FNJgjPc9dDo.crl, http://c.pki.goog/wr1/G7Soy_dFPqQ.crl, http://c.pki.goog/wr1/GCsZGu2HYr4.crl, http://c.pki.goog/wr1/GGcANEKJN3U.crl, http://c.pki.goog/wr1/GKnM0EV0IC4.crl, http://c.pki.goog/wr1/GSri-GRD2Sk.crl, http://c.pki.goog/wr1/GUkhm-45WVE.crl, http://c.pki.goog/wr1/GbUw_GTucPY.crl, http://c.pki.goog/wr1/Gdkxw_qeaqY.crl, http://c.pki.goog/wr1/GdqwacXaYSQ.crl, http://c.pki.goog/wr1/H2Z6kbfqJ3E.crl, http://c.pki.goog/wr1/HQZJQcGy9p4.crl, http://c.pki.goog/wr1/HUglDkbheYM.crl, http://c.pki.goog/wr1/Ha21N9dZ9dE.crl, http://c.pki.goog/wr1/Hh59GXVd_cI.crl, http://c.pki.goog/wr1/HrK16orLZxw.crl, http://c.pki.goog/wr1/IKxmsBfLziY.crl, http://c.pki.goog/wr1/IO8X46YQrxE.crl, http://c.pki.goog/wr1/IUDEbGjPmnE.crl, http://c.pki.goog/wr1/K5aj19Ue4kw.crl, http://c.pki.goog/wr1/KXBt91YUfWs.crl, http://c.pki.goog/wr1/LEOeq63_IrY.crl, http://c.pki.goog/wr1/LVOQywEuoSU.crl, http://c.pki.goog/wr1/L_W8-h-zUeg.crl, http://c.pki.goog/wr1/LsBCCeejKXE.crl, http://c.pki.goog/wr1/MCzQnekA7lc.crl, http://c.pki.goog/wr1/MYamRYv9-W8.crl, http://c.pki.goog/wr1/NshBPXr8bi8.crl, http://c.pki.goog/wr1/NzJhrGTN4CU.crl, http://c.pki.goog/wr1/O9VwX8FZ14o.crl, http://c.pki.goog/wr1/OPAcs8oa8qo.crl, http://c.pki.goog/wr1/OsdCIlpfTHU.crl, http://c.pki.goog/wr1/PHntHWVPhRQ.crl, http://c.pki.goog/wr1/PKjFEKduUEw.crl, http://c.pki.goog/wr1/PLA3mZdR8Z4.crl, http://c.pki.goog/wr1/POFqvMef4EY.crl, http://c.pki.goog/wr1/QHNqq_7Jb2g.crl, http://c.pki.goog/wr1/R5Gak1gBGyU.crl, http://c.pki.goog/wr1/RVCZ_AT1MTE.crl, http://c.pki.goog/wr1/RqNGAH7p6w4.crl, http://c.pki.goog/wr1/S3hvOSet3rM.crl, http://c.pki.goog/wr1/SDWajOrr0gM.crl, http://c.pki.goog/wr1/SXdokb4rTTw.crl, http://c.pki.goog/wr1/SgDVGyx2RHs.crl, http://c.pki.goog/wr1/Sl8eLgZ4Pa0.crl, http://c.pki.goog/wr1/Ss6FijRLk3U.crl, http://c.pki.goog/wr1/TeQVx11FOSE.crl, http://c.pki.goog/wr1/Tjbu285umI0.crl, http://c.pki.goog/wr1/Tjv6T3xEhuQ.crl, http://c.pki.goog/wr1/Togpyr8rP0Q.crl, http://c.pki.goog/wr1/TrI0E2ub6dg.crl, http://c.pki.goog/wr1/U1FnBxsVPp4.crl, http://c.pki.goog/wr1/U1dIS2qjlpQ.crl, http://c.pki.goog/wr1/U5uDzpDk8S0.crl, http://c.pki.goog/wr1/UATVFjL9kAc.crl, http://c.pki.goog/wr1/UBmQVzas85g.crl, http://c.pki.goog/wr1/UFSzLkMIBwE.crl, http://c.pki.goog/wr1/UaNdiIJ1P54.crl, http://c.pki.goog/wr1/UezFalvazBM.crl, http://c.pki.goog/wr1/VQT-5PG0Fr4.crl, http://c.pki.goog/wr1/VbK5YUz_rYs.crl, http://c.pki.goog/wr1/ViwELR1Z7xA.crl, http://c.pki.goog/wr1/W2d7RNGw68Q.crl, http://c.pki.goog/wr1/WFaXJLtXExs.crl, http://c.pki.goog/wr1/WhrJdsP3OM0.crl, http://c.pki.goog/wr1/X0mFOjfzSps.crl, http://c.pki.goog/wr1/X95Wa0j_Jp0.crl, http://c.pki.goog/wr1/XUHqv-18Xpo.crl, http://c.pki.goog/wr1/ZOmesDGxCWE.crl, http://c.pki.goog/wr1/ZXufqlb0NyY.crl, http://c.pki.goog/wr1/ZfO2M5NwwKE.crl, http://c.pki.goog/wr1/_3NOxYLlKC8.crl, http://c.pki.goog/wr1/_WMQVCo8Z40.crl, http://c.pki.goog/wr1/a5sG5m0g7mc.crl, http://c.pki.goog/wr1/aF7ZNfYpLXQ.crl, http://c.pki.goog/wr1/asQRqxmW1Ew.crl, http://c.pki.goog/wr1/bQJYVHX9sV8.crl, http://c.pki.goog/wr1/bcJgaGgPzMY.crl, http://c.pki.goog/wr1/bg-a-G1ME_s.crl, http://c.pki.goog/wr1/bjEfot6mUA0.crl, http://c.pki.goog/wr1/brD8Lo8p_3U.crl, http://c.pki.goog/wr1/bvTdBM-zH8o.crl, http://c.pki.goog/wr1/cthKhdYD25A.crl, http://c.pki.goog/wr1/d0JAPM-sifY.crl, http://c.pki.goog/wr1/d2KuCsub-5s.crl, http://c.pki.goog/wr1/dQvDbkiFQeo.crl, http://c.pki.goog/wr1/e-7pAYSj0dw.crl, http://c.pki.goog/wr1/eOb3OfCtrhU.crl, http://c.pki.goog/wr1/e_okgmrFDi8.crl, http://c.pki.goog/wr1/ehmxk4X0Mqk.crl, http://c.pki.goog/wr1/ei5WS0gsifo.crl, http://c.pki.goog/wr1/ek80I2dDr2Q.crl, http://c.pki.goog/wr1/fVl3KYUairc.crl, http://c.pki.goog/wr1/fXwYrqsj_io.crl, http://c.pki.goog/wr1/ftK2Ud58MoU.crl, http://c.pki.goog/wr1/fwu2FE_RJcI.crl, http://c.pki.goog/wr1/fyYFmqNs_JI.crl, http://c.pki.goog/wr1/g-BVQcdSFnw.crl, http://c.pki.goog/wr1/g2RV4yGQwPQ.crl, http://c.pki.goog/wr1/g2ruAi53nzw.crl, http://c.pki.goog/wr1/gSbUQEF77tM.crl, http://c.pki.goog/wr1/h4pD5FfnZwQ.crl, http://c.pki.goog/wr1/h9zgH6Nkr2o.crl, http://c.pki.goog/wr1/h_-OogFZ624.crl, http://c.pki.goog/wr1/ifaQmXJB86s.crl, http://c.pki.goog/wr1/j3VYW3BQzlk.crl, http://c.pki.goog/wr1/jM2oylRgTIg.crl, http://c.pki.goog/wr1/jWg-VIyZ1sY.crl, http://c.pki.goog/wr1/kBlzwXz4l14.crl, http://c.pki.goog/wr1/kbMxXragnec.crl, http://c.pki.goog/wr1/lxYkhDb6KGg.crl, http://c.pki.goog/wr1/m8CuS-aKZlU.crl, http://c.pki.goog/wr1/msSEnk0gQ7o.crl, http://c.pki.goog/wr1/n20LCWiQGcY.crl, http://c.pki.goog/wr1/n2qNnrU9elw.crl, http://c.pki.goog/wr1/nKPbKSWKKzo.crl, http://c.pki.goog/wr1/nW2drJH3a90.crl, http://c.pki.goog/wr1/nbMIullTy10.crl, http://c.pki.goog/wr1/nfPwEfB02A0.crl, http://c.pki.goog/wr1/oEX4FUvLuAc.crl, http://c.pki.goog/wr1/oR7YbPzYLLw.crl, http://c.pki.goog/wr1/oojBMhtgbJA.crl, http://c.pki.goog/wr1/p3KxEpq-IOg.crl, http://c.pki.goog/wr1/pamJIk1bTO8.crl, http://c.pki.goog/wr1/pmsEG2e147U.crl, http://c.pki.goog/wr1/pt0dBuD_Oi4.crl, http://c.pki.goog/wr1/qmIfXAT9GUg.crl, http://c.pki.goog/wr1/qwbhutgcsJQ.crl, http://c.pki.goog/wr1/qwhagSEQ4SU.crl, http://c.pki.goog/wr1/rB_KlZqq9gA.crl, http://c.pki.goog/wr1/sbCOSVgE-TY.crl, http://c.pki.goog/wr1/snZSHrK7gAY.crl, http://c.pki.goog/wr1/sunH6ORcPog.crl, http://c.pki.goog/wr1/tyyTOlCKhGQ.crl, http://c.pki.goog/wr1/uBlQQO6Tx4k.crl, http://c.pki.goog/wr1/uq86KJw_2tQ.crl, http://c.pki.goog/wr1/vG1jRk4SsDs.crl, http://c.pki.goog/wr1/wsITvfp0cYo.crl, http://c.pki.goog/wr1/x1Cgc4k2LGU.crl, http://c.pki.goog/wr1/x1O_43xhLHo.crl, http://c.pki.goog/wr1/xL7xorDBjI4.crl, http://c.pki.goog/wr1/xx9NZPTJN50.crl, http://c.pki.goog/wr1/y4shtei4deg.crl, http://c.pki.goog/wr1/yXVHWia2JrQ.crl, http://c.pki.goog/wr1/yhFeoOh5QLM.crl, http://c.pki.goog/wr1/yzWwtsqVFFo.crl, http://c.pki.goog/wr1/z1ks8qv0zEs.crl, http://c.pki.goog/wr1/zY5gGCbOxUE.crl, http://c.pki.goog/wr1/zjGRB4jr1-g.crl, http://c.pki.goog/wr1/znr89J6OSLY.crl, http://c.pki.goog/wr1/zqMDWm6NEis.crl, http://c.pki.goog/wr1/zs9euc5hywY.crl, http://c.pki.goog/wr1/zuhU_EF_Siw.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:d9:e2:c2:d2:04:8a:04:74:b6:27:a2:6d:08:68:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WR1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                66:69:49:D4:DE:2A:9C:91:03:CF:89:0E:24:B8:0E:30:03:6E:88:2E
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B10B6F00E609509E8700F6D34687A2BFCE38EA05A8FDF1CDC40C3A2A0D0D0E45
    SPKI SHA256: C83BBDA20DB9E4D3791847FE0706BDAD3AEA150D04C9D674AF514287D4DD016E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r1.crt
- CRL Distribution Points: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WR2

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WR2
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 7FF005A07C4CDED100AD9D66A5107B98
- SHA-256: E6FE22BF45E4F0D3B85C59E02C0F495418E1EB8D3210F788D48CD5E1CB547CD4
- SPKI SHA-256: 60FB4769FB4BC3AFF4BE773606734A185E78C62080DBC58571C723900E32A423
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/wr2/75r4ZyA3vA0.crl, http://c.pki.goog/wr2/9UVbN0w5E6Y.crl, http://c.pki.goog/wr2/GSyT1N4PBrg.crl, http://c.pki.goog/wr2/oBFYYahzgVI.crl, http://c.pki.goog/wr2/oQ6nyr8F0m0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f0:05:a0:7c:4c:de:d1:00:ad:9d:66:a5:10:7b:98
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WR2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DE:1B:1E:ED:79:15:D4:3E:37:24:C3:21:BB:EC:34:39:6D:42:B2:30
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E6FE22BF45E4F0D3B85C59E02C0F495418E1EB8D3210F788D48CD5E1CB547CD4
    SPKI SHA256: 60FB4769FB4BC3AFF4BE773606734A185E78C62080DBC58571C723900E32A423
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r1.crt
- CRL Distribution Points: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WR3

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WR3
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 7FF005A91568D63ABC22861684AA4B5A
- SHA-256: 2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7
- SPKI SHA-256: 39D4A59900FD356261E046DC387071921CA03F0352C00F50F757A8BA77DB7281
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/wr3/-3YewytAhug.crl, http://c.pki.goog/wr3/-JBw_bhOXiU.crl, http://c.pki.goog/wr3/-b3FbceFs6o.crl, http://c.pki.goog/wr3/-xHxY6q5D9E.crl, http://c.pki.goog/wr3/02pQRAZJz60.crl, http://c.pki.goog/wr3/0LnWguNGQfg.crl, http://c.pki.goog/wr3/1ArCr5AmLvw.crl, http://c.pki.goog/wr3/1UWnvFBzWt8.crl, http://c.pki.goog/wr3/1ZuLSsJ11-Y.crl, http://c.pki.goog/wr3/1g73fxQ7SNA.crl, http://c.pki.goog/wr3/1pLeIRbIoJY.crl, http://c.pki.goog/wr3/2U68xcxO-dE.crl, http://c.pki.goog/wr3/2_-HWtgj1Hc.crl, http://c.pki.goog/wr3/2auRz_TLdKw.crl, http://c.pki.goog/wr3/2x_rn3T033Y.crl, http://c.pki.goog/wr3/3ApFGG65rgU.crl, http://c.pki.goog/wr3/3FtIrcPE7Qs.crl, http://c.pki.goog/wr3/3WK4FGvaLfM.crl, http://c.pki.goog/wr3/3gfgdI5fPWk.crl, http://c.pki.goog/wr3/3iKtSd8tRDY.crl, http://c.pki.goog/wr3/3ifoNpfUoQo.crl, http://c.pki.goog/wr3/3q-LT9v5QpA.crl, http://c.pki.goog/wr3/4XBmwvLwFuM.crl, http://c.pki.goog/wr3/5OHvIVFEytg.crl, http://c.pki.goog/wr3/5WOamhaXuNk.crl, http://c.pki.goog/wr3/5XNlR7dSJJI.crl, http://c.pki.goog/wr3/5gV5Jpb4SN0.crl, http://c.pki.goog/wr3/5mWY9GkQxew.crl, http://c.pki.goog/wr3/5w_HVDtm6AI.crl, http://c.pki.goog/wr3/69Ltc8iAVYU.crl, http://c.pki.goog/wr3/6HSHPcChEV4.crl, http://c.pki.goog/wr3/6ePRCsEQW_0.crl, http://c.pki.goog/wr3/6oxboFgspkM.crl, http://c.pki.goog/wr3/7AGuYKv5Kco.crl, http://c.pki.goog/wr3/7e_1Msh1bRU.crl, http://c.pki.goog/wr3/7hiQEM4pOIY.crl, http://c.pki.goog/wr3/85QyHZnkuAw.crl, http://c.pki.goog/wr3/8CStlqNpymw.crl, http://c.pki.goog/wr3/8G5b5sl1Ajw.crl, http://c.pki.goog/wr3/8o439f_zzbQ.crl, http://c.pki.goog/wr3/9IioAqQecHw.crl, http://c.pki.goog/wr3/9V-O1BSMOXo.crl, http://c.pki.goog/wr3/9e1eCUPajhY.crl, http://c.pki.goog/wr3/9xUvJCeNSs0.crl, http://c.pki.goog/wr3/AIItno9Dxlw.crl, http://c.pki.goog/wr3/CRkBycGM1cQ.crl, http://c.pki.goog/wr3/CfnTiHfB-2Y.crl, http://c.pki.goog/wr3/D94Agd8LZ_0.crl, http://c.pki.goog/wr3/DjLBm-i4yCo.crl, http://c.pki.goog/wr3/DtFSeCT5R-U.crl, http://c.pki.goog/wr3/EHVLGGRafuE.crl, http://c.pki.goog/wr3/EoWrCpVqqZA.crl, http://c.pki.goog/wr3/EpRuR3RoBnI.crl, http://c.pki.goog/wr3/FHk0u1laCO4.crl, http://c.pki.goog/wr3/FU63T69c7Zk.crl, http://c.pki.goog/wr3/FgaNwQv_mYQ.crl, http://c.pki.goog/wr3/GYnhMBnlofE.crl, http://c.pki.goog/wr3/GeE2jtXchuI.crl, http://c.pki.goog/wr3/GjFmsPEDK4s.crl, http://c.pki.goog/wr3/HeLLJCgLxhE.crl, http://c.pki.goog/wr3/HquZ_rki8Sg.crl, http://c.pki.goog/wr3/HsIQoMZwbXc.crl, http://c.pki.goog/wr3/IbKPqAbrcUs.crl, http://c.pki.goog/wr3/IpkxrQSMCIU.crl, http://c.pki.goog/wr3/Ixx2rY1I0R0.crl, http://c.pki.goog/wr3/JP0l1THyYsM.crl, http://c.pki.goog/wr3/KAfVVcBW568.crl, http://c.pki.goog/wr3/KE4bfPlsk_8.crl, http://c.pki.goog/wr3/KJRMizGWBt4.crl, http://c.pki.goog/wr3/KLrmej-r6oY.crl, http://c.pki.goog/wr3/KmU_tOkEYyU.crl, http://c.pki.goog/wr3/LD-STRGp7cU.crl, http://c.pki.goog/wr3/LVZQGz4OUv8.crl, http://c.pki.goog/wr3/Lin6UzG9uMc.crl, http://c.pki.goog/wr3/LqyT4hUeGsQ.crl, http://c.pki.goog/wr3/MaRhzPFka6o.crl, http://c.pki.goog/wr3/MbJBMFoQ-sk.crl, http://c.pki.goog/wr3/MhJ2qTP8ZSQ.crl, http://c.pki.goog/wr3/NV5OQBrtD9s.crl, http://c.pki.goog/wr3/NgapK1VY8hU.crl, http://c.pki.goog/wr3/NwTPgoRybTI.crl, http://c.pki.goog/wr3/NwdqRleKBEc.crl, http://c.pki.goog/wr3/ONPJg2Q_E8w.crl, http://c.pki.goog/wr3/OjhGcvA-p4w.crl, http://c.pki.goog/wr3/PBTgX3IAo5A.crl, http://c.pki.goog/wr3/Q1IHrB76X00.crl, http://c.pki.goog/wr3/QFD-W7RJLCQ.crl, http://c.pki.goog/wr3/Q_nPssW8Lcs.crl, http://c.pki.goog/wr3/RfYbo4BMkRU.crl, http://c.pki.goog/wr3/RqT89ooGdns.crl, http://c.pki.goog/wr3/S5z_MAP_58A.crl, http://c.pki.goog/wr3/S9uBEvvBjMU.crl, http://c.pki.goog/wr3/SeW80AgzmpQ.crl, http://c.pki.goog/wr3/SlgOUaKol20.crl, http://c.pki.goog/wr3/T9vF3lgqTwA.crl, http://c.pki.goog/wr3/TBeYeGvtezI.crl, http://c.pki.goog/wr3/TCNtsb7p2sw.crl, http://c.pki.goog/wr3/TPpdXhVuuKw.crl, http://c.pki.goog/wr3/TQRvExpQUJE.crl, http://c.pki.goog/wr3/U6RUXYpOs3s.crl, http://c.pki.goog/wr3/UKhWJckfWGE.crl, http://c.pki.goog/wr3/UU8pwFkWD50.crl, http://c.pki.goog/wr3/UxjT0N8epZg.crl, http://c.pki.goog/wr3/VBg4HqhBUlE.crl, http://c.pki.goog/wr3/VXgRL90Sqwg.crl, http://c.pki.goog/wr3/VZJ_VjnQOjo.crl, http://c.pki.goog/wr3/Vex7y5Z5Xj0.crl, http://c.pki.goog/wr3/VupO-9cFG5k.crl, http://c.pki.goog/wr3/W1MeLi-BkqU.crl, http://c.pki.goog/wr3/WEXcS1DHFOk.crl, http://c.pki.goog/wr3/WNzeCfBXSXI.crl, http://c.pki.goog/wr3/X-ugCjoFjuA.crl, http://c.pki.goog/wr3/XX7o_-5KB0c.crl, http://c.pki.goog/wr3/YLaHk7MHtCo.crl, http://c.pki.goog/wr3/YQXPeQxHf0k.crl, http://c.pki.goog/wr3/YgkTTVgwkiw.crl, http://c.pki.goog/wr3/ZYRyxefBEyE.crl, http://c.pki.goog/wr3/ZYtWHI7dWM4.crl, http://c.pki.goog/wr3/_7SdRtj2WrI.crl, http://c.pki.goog/wr3/_YzGagdrj00.crl, http://c.pki.goog/wr3/_tX5ASFloZY.crl, http://c.pki.goog/wr3/aQd59BNjD5A.crl, http://c.pki.goog/wr3/aQfP_me05uM.crl, http://c.pki.goog/wr3/aUMW_qvJjAw.crl, http://c.pki.goog/wr3/aZiaM0YSdbU.crl, http://c.pki.goog/wr3/akEIUQXkyNo.crl, http://c.pki.goog/wr3/aoQHM7OuxaU.crl, http://c.pki.goog/wr3/azKYOVTZKa0.crl, http://c.pki.goog/wr3/baFvOwbr8-E.crl, http://c.pki.goog/wr3/bgFh02uYsys.crl, http://c.pki.goog/wr3/c-aSMVQF_hk.crl, http://c.pki.goog/wr3/c-sHt_ZBc2U.crl, http://c.pki.goog/wr3/c73BBtMZEBQ.crl, http://c.pki.goog/wr3/ccEnMZB4Ezs.crl, http://c.pki.goog/wr3/cemuivg75Xk.crl, http://c.pki.goog/wr3/d2ZFk07UT-s.crl, http://c.pki.goog/wr3/d2ctWCrE-cw.crl, http://c.pki.goog/wr3/d76w8Tav41k.crl, http://c.pki.goog/wr3/dGg2sVWBMDk.crl, http://c.pki.goog/wr3/dRcOc4pi4GY.crl, http://c.pki.goog/wr3/djN3QJ4eEt4.crl, http://c.pki.goog/wr3/e2tPQN3803E.crl, http://c.pki.goog/wr3/eVzCmQqMVB8.crl, http://c.pki.goog/wr3/eqQQHcCSwug.crl, http://c.pki.goog/wr3/erbODBgiYsQ.crl, http://c.pki.goog/wr3/ezZT115KZvk.crl, http://c.pki.goog/wr3/f4BcoiuHESQ.crl, http://c.pki.goog/wr3/fqlubeBRsyI.crl, http://c.pki.goog/wr3/g3EWGX31eDo.crl, http://c.pki.goog/wr3/gHKiB2eAd6E.crl, http://c.pki.goog/wr3/h6QG0si2kgY.crl, http://c.pki.goog/wr3/hD16AlvCGng.crl, http://c.pki.goog/wr3/hHvoUaVG06Q.crl, http://c.pki.goog/wr3/hSttNV6Diy4.crl, http://c.pki.goog/wr3/i5NXTgndAZY.crl, http://c.pki.goog/wr3/iClmnah11BI.crl, http://c.pki.goog/wr3/iPxquZbxz7w.crl, http://c.pki.goog/wr3/iqVnObtczss.crl, http://c.pki.goog/wr3/j0FPpPT5upA.crl, http://c.pki.goog/wr3/j4D3Tr5YkBE.crl, http://c.pki.goog/wr3/j4S1MGrEg-o.crl, http://c.pki.goog/wr3/j6MjKixxsnk.crl, http://c.pki.goog/wr3/kei6w5yrI_Q.crl, http://c.pki.goog/wr3/mIQixau_r-Y.crl, http://c.pki.goog/wr3/nMI7ramGKcs.crl, http://c.pki.goog/wr3/oOLGW0WUdNE.crl, http://c.pki.goog/wr3/oXl3c9bR9gU.crl, http://c.pki.goog/wr3/oeAAi08uy9Y.crl, http://c.pki.goog/wr3/ooWtebs1w0g.crl, http://c.pki.goog/wr3/pWMcua2EXkY.crl, http://c.pki.goog/wr3/pf1nUgEQ3F8.crl, http://c.pki.goog/wr3/qAvZ910MMZI.crl, http://c.pki.goog/wr3/qBnwRZzbQD8.crl, http://c.pki.goog/wr3/qGSfjyEQzB8.crl, http://c.pki.goog/wr3/qZEUFTzUgjw.crl, http://c.pki.goog/wr3/qjLZ9pU_vaU.crl, http://c.pki.goog/wr3/qms0OAXgtIg.crl, http://c.pki.goog/wr3/qy0YpgMMct4.crl, http://c.pki.goog/wr3/rBOv5qmganE.crl, http://c.pki.goog/wr3/rPjG4_GfzHg.crl, http://c.pki.goog/wr3/rmR3acu_ySI.crl, http://c.pki.goog/wr3/rpdIoNLnC3U.crl, http://c.pki.goog/wr3/rrfRGTIX-Lc.crl, http://c.pki.goog/wr3/sH5Ck56DCrE.crl, http://c.pki.goog/wr3/tYXkA6tvEEI.crl, http://c.pki.goog/wr3/tvGcHoQUGGo.crl, http://c.pki.goog/wr3/uZWIRKUOrNs.crl, http://c.pki.goog/wr3/unX8VSCHquo.crl, http://c.pki.goog/wr3/ureRmHvBcxQ.crl, http://c.pki.goog/wr3/vN6gLeBxqZM.crl, http://c.pki.goog/wr3/wxbUw4TP6qE.crl, http://c.pki.goog/wr3/x-9e2aqSj9g.crl, http://c.pki.goog/wr3/xHGNLJifGCE.crl, http://c.pki.goog/wr3/xNmLyP3CgUE.crl, http://c.pki.goog/wr3/xhPuidBZM08.crl, http://c.pki.goog/wr3/xy1Nf43GmX8.crl, http://c.pki.goog/wr3/yb_Gu5EyKrs.crl, http://c.pki.goog/wr3/zP_uW7VrfQU.crl, http://c.pki.goog/wr3/zSVNMY0D4w8.crl, http://c.pki.goog/wr3/zYdZL842DpI.crl, http://c.pki.goog/wr3/zZMK7vjKJRM.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f0:05:a9:15:68:d6:3a:bc:22:86:16:84:aa:4b:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WR3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C7:81:F5:FD:8E:88:D9:00:3C:4D:63:A2:50:31:24:A0:CE:23:FE:23
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7
    SPKI SHA256: 39D4A59900FD356261E046DC387071921CA03F0352C00F50F757A8BA77DB7281
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r1.crt
- CRL Distribution Points: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WR4

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WR4
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R1
- Serial: 7FF005B4DA75B86A5AC61FE4307713CD
- SHA-256: DC9416C2F855126D6DE977677538F2F967FF4998E90DFA435A17219BE077FC06
- SPKI SHA-256: 8597B539EAEA2753E7ABA1783748158E3A47AA6D37ECD75FE1A2CB5696597401
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/wr4/BshcCqg2aeg.crl, http://c.pki.goog/wr4/EMKwDOyQGIo.crl, http://c.pki.goog/wr4/F-WFK5nQurE.crl, http://c.pki.goog/wr4/M6S2FnPYkvQ.crl, http://c.pki.goog/wr4/Ue1IwGN0G1E.crl, http://c.pki.goog/wr4/bERfMHAF9OE.crl, http://c.pki.goog/wr4/c6lhWchYnj8.crl, http://c.pki.goog/wr4/dTLo4_xfsis.crl, http://c.pki.goog/wr4/fKtyNWJ_nrE.crl, http://c.pki.goog/wr4/t60nm5-mt_w.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f0:05:b4:da:75:b8:6a:5a:c6:1f:e4:30:77:13:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WR4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9B:C8:11:BC:3D:AA:36:B9:31:8C:4E:8F:44:D5:57:32:2F:C3:C0:61
            X509v3 Authority Key Identifier:
                E4:AF:2B:26:71:1A:2B:48:27:85:2F:52:66:2C:EF:F0:89:13:71:3E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC9416C2F855126D6DE977677538F2F967FF4998E90DFA435A17219BE077FC06
    SPKI SHA256: 8597B539EAEA2753E7ABA1783748158E3A47AA6D37ECD75FE1A2CB5696597401
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r1.crt
- CRL Distribution Points: http://c.pki.goog/r/r1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### WR5

- Subject: countryName=US, organizationName=Google Trust Services, commonName=WR5
- Issuer: countryName=US, organizationName=Google Trust Services LLC, commonName=GTS Root R2
- Serial: 7FF4E5C91496B0F2A18905ED501E62A3
- SHA-256: AE0FC852280F1B87CEDAF73CFB84CF106EFEC88E8294253AF352ED4034460D7B
- SPKI SHA-256: FD1A3078CC97F23F3F7C069A780230CE15978A0643AE1FC9D81049687AE35FDD
- Validity: 2023-12-13 to 2029-02-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.pki.goog/wr5/axjnYyJzahk.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://c.pki.goog/r/r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:f4:e5:c9:14:96:b0:f2:a1:89:05:ed:50:1e:62:a3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
        Validity
            Not Before: Dec 13 09:00:00 2023 GMT
            Not After : Feb 20 14:00:00 2029 GMT
        Subject: C = US, O = Google Trust Services, CN = WR5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4C:5B:19:C2:8F:1A:7F:55:6F:AA:10:29:FA:02:8B:C7:3C:2A:22:3C
            X509v3 Authority Key Identifier:
                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
            Authority Information Access:
                CA Issuers - URI:http://i.pki.goog/r2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://c.pki.goog/r/r2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AE0FC852280F1B87CEDAF73CFB84CF106EFEC88E8294253AF352ED4034460D7B
    SPKI SHA256: FD1A3078CC97F23F3F7C069A780230CE15978A0643AE1FC9D81049687AE35FDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://i.pki.goog/r2.crt
- CRL Distribution Points: http://c.pki.goog/r/r2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers
